Europol announces the arrest of two alleged ransomware gang members in Ukraine, with help from US and French authorities, as some think they may belong to REvil
Two members of a ransomware gang were arrested in Ukraine following a joint international law enforcement operation. Source: Europol .
Context & Ripple Effects
This arrest lands mid-surge: within the same month, Reuters sources reported that [[a:972062|REvil was hacked and forced offline by a multi-country operation including US law enforcement]], and days later Europol announced twelve detainees tied to ransomware attacks on 1,800+ victims across 71 countries. The two arrests in Ukraine, made with US and French support and possibly involving REvil members, extend that same coordinated campaign onto Ukrainian soil.
Ukraine as an operating ground for ransomware crews is a recurring theme — Europol returned to Ukrainian territory again two years later for a multinational takedown of a group attacking organizations across 71 countries, and separately moved against alleged REvil and GandCrab affiliates running thousands of attacks since 2019.
First-order effects
- Two suspected gang members are now in custody in Ukraine, and if the REvil attribution holds, the group loses operational personnel while it is already reeling from being forced offline by law enforcement earlier that month.
Second-order effects
- REvil's remaining affiliates face a shrinking safe-harbor map: successive joint operations — from the October detentions of twelve suspects to the November arrests of seven alleged REvil and GandCrab helpers — push surviving crews to relocate infrastructure and recruitment away from jurisdictions cooperating with Europol.
Third-order effects
- The pattern points toward standing cross-border task forces rather than one-off raids: repeated US-French-Europol-Ukraine coordination normalizes rapid extradition-style takedowns of ransomware operators wherever they base themselves, raising the long-term operating cost of affiliate-based ransomware models.
The trend: Ransomware enforcement is consolidating into persistent multi-country operations that dismantle gangs like REvil through sequential arrests across their host jurisdictions.