Authorities in Moldova on Monday announced the arrest of an individual suspected of being involved in DoppelPaymer ransomware attacks.
The suspect, a 45-year-old foreigner whose identity was not disclosed, was wanted for his alleged involvement in ransomware attacks, extortion, and money laundering against organizations in the Netherlands.
Moldovan authorities, with support from Dutch law enforcement, searched the suspect’s house and car, and seized two laptops, a mobile phone, a tablet, two portable drives, six memory cards, six bank cards, an electronic wallet, and €84,800 (~$94,000).
According to Moldovan authorities, the suspect was involved in a ransomware attack against the Dutch Research Council (NWO), causing roughly €4.5 million (~$5 million) in losses. The individual remains in custody, awaiting extradition to the Netherlands.
The scientific organization disclosed the attack in February 2021, saying that the DoppelPaymer ransomware was used, that network drives were blocked, and that some files were stolen. NWO did not pay a ransom and the ransomware group published the stolen files online.
The DoppelPaymer ransomware emerged in 2019, as a forked version of BitPaymer, believed to be linked to TA505, also known as Evil Corp, the cybercrime group behind the Dridex Trojan and Locky ransomware.
It was used in attacks against critical infrastructure, as well as organizations in the healthcare, education, and other sectors.
In February 2023, authorities in Germany and Ukraine, with support from the FBI, Europol, and Dutch law enforcement, raided several locations in a coordinated operation against the DoppelPaymer ransomware-as-a-service (RaaS) operation.
In March 2023, Europol announced that eleven individuals associated with the RaaS were identified and that some were detained. However, three key members of the group, Igor Olegovich Turashev, Irina Zemlianikina, and Igor Garshin, believed to be located in Russia, remained at large.
Related: LockBit Ransomware Admin Panel Hacked, Leaks Reveal Inside Details
Related: Europol Announces More DDoS Service Takedowns, Arrests
Related: 300 Arrested in Crackdown on Cybercrime Rings in Africa
Related: Authorities Disrupt 8Base Ransomware, Arrest Four Russian Operators