This morning, Ukrainian police arrested six individuals linked to the Cl0p ransomware group. Ukrainian authorities issued a press release on Wednesday, June 16, to announce the operation. It was coordinated by Interpol and conducted in collaboration with officers from the United States and South Korea.
Authorities announced that they carried out 21 searches of homes and cars belonging to the suspects in the Kyiv region. Computer equipment, cars and nearly 5 million hryvnias (about CA$225,000) were seized.
At this time, we do not know whether these are key members of the Cl0p group or affiliates. Organizations like Cl0p, which offer ransomware as a service, recruit affiliates. It is these affiliates who infiltrate vulnerable computer networks and deploy the malware provided by the group.
Groups like Cl0p provide the software used to encrypt the victim’s data, the website used to publish stolen documents and a platform to negotiate the ransom. Profits are then shared between the affiliates and the service provider.
This morning, the group’s leak site, hosted on the Tor network, was still accessible.
The Cl0p group was behind the recent attacks against Bombardier, as well as against the Regional Municipality of Durham in Ontario and the Boutin transport company here in Québec. It is too early to know whether the people arrested today are responsible for these attacks, or whether they belong to another group of affiliates.
This article was corrected on 18/06 to fix the amount seized in Canadian dollars.
