German police, Europol, the FBI, and Ukrainian police disrupt a ransomware gang that deployed DoppelPaymer; Europol says US victims paid €40M+ from 2019 to 2021
Associated Press :
Context & Ripple Effects
The DoppelPaymer action extends a visible pattern of Ukrainian, US and European cooperation against ransomware operators. Earlier, Europol described a 12-suspect operation spanning 71 countries, while another Ukraine-based arrest effort involved US and French assistance.
The reported ransom total gives the disruption a concrete victim-cost dimension: the group’s activity generated substantial payments from US targets before the coordinated intervention.
First-order effects
- The disruption immediately constrains the DoppelPaymer operators targeted by German police, Europol, the FBI and Ukrainian police, interrupting their ability to run the campaign as before.
- Europol and the FBI can use the operation and its record of US victim payments to support follow-on investigations into the gang’s participants and infrastructure.
Second-order effects
- Other ransomware operators relying on cross-border personnel or infrastructure face greater operational risk as German, Ukrainian, US and European authorities demonstrate a workable joint-enforcement model.
- Victims and incident-response teams have a stronger reason to retain intrusion and payment evidence, since cross-border cases depend on linking attacks, operators and ransom flows across jurisdictions.
Third-order effects
- If such operations continue, ransomware enforcement is likely to rely less on isolated national cases and more on multinational disruption campaigns that target operators, infrastructure and financial trails together.
- The later botnet-and-domain takedown points to the same broader shift: authorities are increasingly pursuing the delivery infrastructure that enables ransomware, not only alleged operators.
The trend: Ransomware enforcement is becoming a coordinated international campaign against the people, infrastructure and payment pathways behind attacks.