Europol: Romanian police nab 5 ransomware suspects

By Ahmet Sait Akcay

ANKARA (AA) – Over the last week Romanian police have detained five suspects for spreading ransomware through Europe and the U.S., according to the European police agency Europol.

“During the last week, Romanian authorities have arrested three individuals who are suspected of infecting computer systems by spreading the CTB-Locker (Curve-Tor-Bitcoin Locker) malware -- a form of file-encrypting ransomware. Two other suspects from the same criminal group were arrested in Bucharest in a parallel ransomware investigation linked to the US,” said a Europol statement.

The arrests came after a joint investigation carried out by the Romanian Police’s cybercrime division, Romanian and Dutch prosecutors, the Dutch National Police, the U.K. National Crime Agency, and the FBI, with the support of Europol’s European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce (J-CAT).

During searches in Romania, police confiscated a significant number of hard drives, laptops, external storage devices, cryptocurrency mining devices, and documents.

“The criminal group is being prosecuted for unauthorized computer access, serious hindering of a computer system, misuse of devices with the intent of committing cybercrimes and blackmail,” said the statement.

CTB-Locker, first detected in 2014, targets almost all versions of Windows, including XP, Vista, 7 and 8.

“Once infected, all documents, photos, music, videos, etc. on the device are encrypted asymmetrically, which makes it very difficult to decrypt the files without the private key in possession of the criminals, which might be released when victims pay the ransom,” it added.

To date, police have identified more than 170 victims across Europe.