Europol says it has detained 12 suspects for orchestrating ransomware attacks that hit 1,800+ victims across 71 countries since 2019
Catalin Cimpanu / The Record :
Context & Ripple Effects
This detention wave lands ten days after Europol announced the arrest of two alleged ransomware gang members in Ukraine with US and French help, and within a week it was followed by a Romanian-led operation that netted seven suspects accused of supporting REvil and GandCrab across more than 7,000 cyberattacks since early 2019. Read together, October–November 2021 marks a shift from chasing ransomware brands to sweeping up the people who run them.
The 12 suspects here are accused of orchestrating attacks on over 1,800 victims in 71 countries since 2019 — a scale that makes them operators rather than foot soldiers, and makes the case a template for the multinational actions that followed, including the disruption of the DoppelPaymer-deploying gang by German, US, FBI, and Ukrainian forces.
First-order effects
- Twelve suspected operators are off the board, and the attack chain behind 1,800+ victims in 71 countries loses its coordinators — immediate relief for targeted organizations and a live evidence base for prosecutors in multiple jurisdictions.
- Europol gains a publicized win that strengthens its pitch to national police forces for joining future joint ransomware operations.
Second-order effects
- The follow-on Romanian-led arrests show takedowns expanding from orchestrators to the support cast — affiliates and helpers around REvil and GandCrab — forcing remaining crews to treat every partner as an arrest risk.
- With operators and helpers being picked off, pressure migrates downstream to money movement, the lane later targeted when Europol dismantled the AudiA6 mixing service accused of laundering over $380M for ransomware actors.
Third-order effects
- The recurring cast — Europol plus the US, Ukraine, France, Romania, Norway — points toward standing multinational disruption campaigns aimed at ransomware's division of labor rather than single-brand takedowns, a structure visible again in the 2023 Ukraine arrests of a group linked to attacks in 71 countries.
- Arrests displace rather than delete capability: if the pattern holds, ransomware groups respond by hardening opsec and rotating personnel, keeping law enforcement in a permanent attrition contest instead of delivering a decisive blow.
The trend: Ransomware enforcement is evolving from isolated arrests into continuous multinational campaigns that target the entire criminal supply chain — operators, affiliates, and launderers alike.