Ukraine cracks global hacking ring behind billions in damages — FBI offers USD 10M for leader

Ukraine cracks global hacking ring behind billions in damages — FBI offers USD 10M for leader

Ukrinform
Ukrainian law enforcement, in cooperation with authorities from the United States, EU countries, and Europol, dismantled a hacker group that blocked access to servers of major global companies in order to extort ransom payments.

According to Ukrinform, the Office of the Prosecutor General reported this.

One of the group’s leaders has been charged in absentia and placed on an international wanted list. The U.S. Federal Bureau of Investigation (FBI) has offered up to $10 million for information about his whereabouts.

Investigators established that since 2018, the suspects had attacked servers of companies in France, Norway, Germany, the Netherlands, Canada, and the U.S., encrypting more than 1,000 servers and causing damages exceeding 3 billion hryvnias.

In August 2024, a pre-trial investigation was completed against one of the group’s most active members. He is accused of unauthorized interference with information systems, creating malicious software, and extortion — crimes punishable by up to 12 years in prison.

The investigation uncovered the full structure of the group — from developers of malicious software and specialists in breaching corporate systems to individuals who laundered the illicit profits.

The attackers used ransomware programs LockerGoga, MegaCortex, HIVE, and Dharma. They blocked access to servers and demanded ransom in cryptocurrency.

Several members of the network were arrested in Ukraine as part of the investigation, and some have already faced trial.

A foreign national who was on the international wanted list has been extradited to the United States.

Read also: Microsoft: Russian hackers spy on foreign embassies in Moscow

As reported earlier, in April, Ukraine’s Security Service, together with the National Police and with assistance from Czech authorities, carried out a large-scale special operation to neutralize an international hacker group that was stealing from bank accounts and cryptocurrency wallets of EU and U.S. citizens.

First photo: Freepik

While citing and using any materials on the Internet, links to the website ukrinform.net not lower than the first paragraph are mandatory. In addition, citing the translated materials of foreign media outlets is possible only if there is a link to the website ukrinform.net and the website of a foreign media outlet. Materials marked as "Advertisement" or with a disclaimer reading "The material has been posted in accordance with Part 3 of Article 9 of the Law of Ukraine "On Advertising" No. 270/96-VR of July 3, 1996 and the Law of Ukraine "On the Media" No. 2849-Х of March 31, 2023 and on the basis of an agreement/invoice.

Online media entity; Media identifier - R40-01421.

© 2015-2025 Ukrinform. All rights reserved.

Extended searchHide extended search
By period:
-