2023 Cybercrime Roundup: Arrests and Takedowns Disrupt Ransomware and Fraud Operations
Summary
DarkOwl reviews major 2023 law-enforcement actions, including arrests and infrastructure seizures targeting ransomware groups, cybercrime services, malware operations, and fraud. It notes some groups quickly resumed activity after disruptions.
Key points
- The FBI said its Hive operation infiltrated the group’s servers, provided victims with decryption keys, and helped seize infrastructure; authorities later arrested a person in France accused of laundering ransom payments.
- Europol reported disrupting Ragnar Locker infrastructure in October 2023, alongside the arrest of an alleged key member.
- The FBI said it dismantled the Warzone RAT operation and arrested two people in Nigeria and Malta, while seizing multiple domains.
- Interpol’s Africa Cyber Surge II operation led to arrests and infrastructure takedowns linked to scams, credit-card fraud, and other cybercrime.
- U.S. authorities charged Denis Kulkov over the Try2Check stolen-card checking service; the article says he remained in Russia.
- The article says BreachForums returned after administrator Conor Fitzpatrick’s arrest and notes that later ransomware-group disruptions, including those involving BlackCat/ALPHV and LockBit, were short-lived.
Article Details
- Event Type
- Law enforcement arrests, prosecutions, and infrastructure disruptions targeting cybercriminals and criminal operations during 2023.
- Impact
- Authorities arrested or prosecuted individuals linked to cybercrime, disrupted or seized infrastructure associated with Hive, Ragnar Locker, and Warzone RAT, and provided decryption keys to Hive victims. The article reports impacts including more than 1,500 victims of Hive across over 80 countries, infrastructure takedowns, and losses or seizures involving ransom payments, cryptocurrency, drugs, and other assets. It also notes that some ransomware groups resumed activity after disruption.
People
Arion KurtajFound guilty of conducting cyberattacks as part of Lapsus$ and sentenced to indefinite detention in a hospital.Conor Brian FitzpatrickArrested and charged in connection with his alleged administration of BreachForums; the article says he admitted to the majority of the offenses.Denis Gennadievich KulkovCharged by the DOJ in connection with operating Try2Check, a card-checking service used by cybercriminals.
Threat Actors
HiveRansomware group whose infrastructure was infiltrated and disrupted by the FBI and partners.LAPSUS$Criminal gang associated with cyberattacks against major companies; two teenagers were found guilty of attacks as part of the gang.Ragnar LockerRansomware group whose associated infrastructure was disrupted by Europol and French authorities.
Malware
Countries
CameroonCameroon: 3 suspects arrested for $850,000 online art scam.CanadaA year later, another member was apprehended in Canada.GambiaGambia: 185 malicious IPs taken down through proactive measures and partnerships.KenyaKenya: 615 malware hosters taken down by authorities.LatviaFurther individuals were also interviewed in Spain and Latvia.MaltaIn February 2023, the FBI announced that it had dismantled the Warzone RAT operation, arresting two individuals associated with the malware – in Nigeria and Malta.MauritiusMauritius: 2 money mules arrested linked to messaging platform scams.NigeriaNigeria: 1 individual arrested for defrauding a Gambian victim.RussiaSecret Service, he remains in Russia, beyond U.S.SpainFurther individuals were also interviewed in Spain and Latvia.UkraineTwo suspects associated with the ransomware crew were previously arrested from Ukraine in 2021.United KingdomIn August 2023, two teenagers in the United Kingdom were found guilty of conducting cyberattacks against Uber, Nvidia, Rockstar Games, and Okta, among others as part of the criminal gang Lapsus$.