The FBI, the UK's NCA, and others seize the servers and websites of the Radar/Dispossessor ransomware operation; since August 2023, the gang targeted 43+ SMBs
The FBI announced on Monday that it seized the servers and websites of the Radar/Dispossessor ransomware operation following a joint international investigation.
Context & Ripple Effects
This action extends a run of multinational ransomware takedowns involving the FBI and UK authorities. The same partners were part of the LockBit disruption that seized thousands of domains earlier in 2024, while prior operations also targeted ALPHV's leak infrastructure.
The Radar/Dispossessor case matters because its reported victim base is small and medium-sized businesses: operators' servers and web presence are central to coordinating attacks, publishing stolen data, and exerting pressure on victims.
First-order effects
- Radar/Dispossessor loses the seized servers and websites, immediately interrupting parts of its operational and public-facing infrastructure.
- The more than 43 targeted SMBs may face reduced near-term exposure to the gang's extortion and leak-site pressure, though the seizure alone does not establish that stolen data or all attacker access has been recovered.
Second-order effects
- The group will have to rebuild or move infrastructure to resume operations, raising its short-term operating friction and weakening continuity with affiliates and victims.
- The action reinforces the value of cross-border infrastructure seizures used against ALPHV's dark-web leak sites, encouraging ransomware operators to distribute or conceal their hosting more aggressively.
Third-order effects
- Repeated seizures point to ransomware enforcement focusing not only on individual suspects but on the web, hosting, and communications layer that makes extortion scalable.
- If this pattern persists, ransomware groups may become more operationally fragmented; that can complicate attribution and victim recovery even as coordinated disruptions shorten the life of visible criminal infrastructure.
The trend: International law enforcement is increasingly treating ransomware infrastructure as a repeatable disruption target, alongside the pursuit of the people running it.