Ukrainian cyber police have dismantled a large-scale transnational cybercrime operation. The investigation was conducted in cooperation with law enforcement agencies from France and the United States.
Authorities identified a 33-year-old French national as the organizer of the illegal operation, which involved running an unauthorized internet service provider within Ukraine. Since 2022, the company’s server infrastructure had been exploited by cybercriminals to host websites engaged in the distribution of child pornography, illegal drug sales, trading of stolen data, spreading malware, and money laundering.
According to international partners, up to 70% of child pornography distributed in the Ukrainian segment of the internet was linked to this infrastructure. Investigators also discovered that one of the most notorious illegal online marketplaces operated on these servers, boasting tens of thousands of users. The platform facilitated a wide range of cybercrimes, including attacks on banking institutions, hacking of computer systems and smartphones, and the laundering of illicit cryptocurrency.
Law enforcement carried out searches at the suspect's residence and a data center in Kyiv. Evidence was seized, including server equipment, computer hardware, digital storage devices, and documentation.
In a separate action, Italian and Romanian law enforcement dismantled a Romanian ransomware group known as Diskstation, which had paralyzed businesses in Italy’s Lombardy region by encrypting their systems and demanding large ransom payments. The operation, codenamed ‘Operation Elicius,’ targeted a ransomware campaign also known as "DiskStation Security" and "Umbrella Security" that had been attacking Synology NAS devices worldwide since 2021.
The attackers exploited internet-exposed NAS systems, encrypting data and demanding ransoms from $10,000 to several hundred thousand dollars in cryptocurrency. Affected victims included graphic and film production companies, event organizers, and NGOs involved in civil rights and charity work.
A 44-year-old Romanian man, believed to be the main operator, was arrested and is now in pre-trial detention facing charges of unauthorized access to computer systems and extortion.