German police, Europol, FBI, and Ukrainian authorities disrupt a ransomware gang that deployed DoppelPaymer; Europol says US victims paid out €40M+ in 2019-2021
German police said Monday that they have disrupted an international cybercrime gang which has been blackmailing large companies …
Context & Ripple Effects
Ukraine has quietly become the recurring arrest ground in Europe's ransomware crackdown: Europol first picked up two suspected gang members there in October 2021 with US and French help, then a wider sweep of twelve operators blamed for attacks on more than 1,800 victims across 71 countries. The DoppelPaymer disruption follows the same template — German police, Europol, the FBI, and Ukrainian authorities moving against a crew whose US victims alone paid out over €40M between 2019 and 2021.
First-order effects
- The DoppelPaymer operation loses its people and infrastructure, cutting off an extortion pipeline that had extracted €40M+ from US victims alone over three years.
- Companies that were in DoppelPaymer's targeting pool get a reprieve, though any data already leaked or encrypted before the disruption stays compromised.
Second-order effects
- Affiliates and money-laundering partners attached to the gang migrate to other ransomware brands, which is exactly what happened after the earlier sweeps — later operations such as the November 2023 Ukraine arrests show successor groups filling the same space.
- Europol and its partners double down on the playbook, scaling it up to infrastructure-level takedowns like the 2024 botnet operation that seized 2,000+ domains spreading ransomware by email.
Third-order effects
- The pattern points to ransomware enforcement as a permanent, rolling campaign of disruption rather than decisive takedowns: each arrest degrades one crew while the affiliate model lets capability reconstitute under new names.
- Sustained joint operations normalize Germany-US-Ukraine police coordination against cybercrime even amid broader geopolitical friction, making cross-border raids the default response rather than the exception.
The trend: Multinational police coalitions are running a continuous disrupt-and-arrest cycle against ransomware crews in Ukraine and Eastern Europe, trading permanent dismantlement for repeated degradation of the ecosystem.