Loading story…
Ukrainian, French, and U.S. authorities disrupted the Egregor ransomware operation through coordinated raids in Ukraine that led to the arrest of three suspected members and targeted alleged ring leaders and affiliate associates. Investigators linked the case to attacks on French organizations including Ubisoft, Gefco, and Ouest France, while Ukrainian officials said Egregor had struck more than 150 companies and caused losses exceeding $80 million. After the operation, Egregor’s leak site went offline, indicating a major blow to the group, which researchers and investigators have also tied to the former Maze ransomware ecosystem.
In a parallel international action, the U.S. Department of Justice announced a global disruption of NetWalker, another ransomware-as-a-service operation, charging Canadian national Sebastien Vachon-Desjardins, seizing about $454,530 in cryptocurrency, and taking down a dark web site used to communicate with victims. The DOJ said NetWalker hit healthcare providers, municipalities, schools, universities, law enforcement, and emergency services, with healthcare organizations particularly targeted during the COVID-19 pandemic. French investigators said ransomware cases remain difficult because attackers move faster than judicial processes, forcing police to rely on infrastructure mapping, indicators of compromise, and private-sector intelligence to identify operators and support cross-border takedowns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On February 9, 2021, Ukrainian law enforcement, working with U.S. and French authorities, conducted an operation against several Ukrainian nationals allegedly involved in Egregor ransomware. The action targeted suspected ring leaders and associates connected to Egregor’s affiliate programs.
The U.S. Department of Justice announced a coordinated international operation against NetWalker that included charges against Sebastien Vachon-Desjardins and the seizure of a dark web hidden service used to communicate with victims. Bulgarian authorities assisted in the hidden service seizure, and the FBI Tampa Field Office led the investigation.
Law enforcement seized approximately $454,530.19 in cryptocurrency on Jan. 10 as part of the NetWalker investigation. The funds were described as ransom payments from three separate NetWalker attacks.
Maze announced in late 2020 that it was shutting down operations. Threat intelligence professionals widely believed many Maze affiliates later moved to Egregor.
Following the February 2021 law enforcement action, Egregor’s leak blog was taken offline. The disruption was cited as evidence that the raids significantly impacted the ransomware operation.
French and Ukrainian authorities arrested three suspected members of the Egregor ransomware operation in Ukraine. French police said one suspect appeared deeply involved with the main actor, while two others provided support including privilege escalation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
intel471.com
Open sourcetherecord.media
Open sourcejustice.gov
Open sourcekrebsonsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
International law enforcement agencies have intensified efforts to disrupt the infrastructure of prominent malware and ransomware operations. Europol, as part of Operation Endgame, targeted the servers supporting the Rhadamanthys information stealer, resulting in a sudden loss of access for its operators and a halt in observed activity since late October 2025. Rhadamanthys, a C++-based stealer-as-a-service, had been widely distributed through phishing campaigns and malicious ads, with its latest version released in October 2025. The operation's impact on the long-term viability of Rhadamanthys remains to be seen, but the immediate effect has been a significant reduction in its activity. In parallel, law enforcement agencies across the US and Europe have made notable arrests and infrastructure takedowns targeting ransomware groups. The UK’s National Crime Agency apprehended a suspect linked to a ransomware attack that disrupted multiple European airports, while US authorities filed charges against the administrator of several notorious ransomware gangs and seized assets from a Zeppelin ransomware distributor. Additionally, a coordinated international operation dismantled the infrastructure of the BlackSuit ransomware group, further demonstrating the global commitment to combating cybercrime. These actions collectively signal a robust and ongoing crackdown on cybercriminal operations by international authorities.
Jul 12, 2026
Egregor emerged as a ransomware-as-a-service operation tied to the **Sekhmet/Maze** lineage and rapidly targeted organizations worldwide, including at least **69 victims** observed by France’s ANSSI, with some ransom demands exceeding **$4 million**. The group encrypted files with randomized extensions, dropped the ransom note `RECOVER-FILES.txt`, and threatened to publish stolen data within three days if victims did not negotiate through Tor-based payment and chat portals. Researchers linked Egregor to former Maze affiliates based on code overlap, shared infrastructure, similar ransom notes, and the migration of operators after Maze’s shutdown. Intrusions commonly began with phishing or illicit **RDP** access and frequently involved **Qakbot**, **IcedID**, **Ursnif**, **Cobalt Strike**, **AdFind**, **SharpHound**, **PsExec**, and **RClone** for reconnaissance, lateral movement, and exfiltration before encryption. Technical analyses described obfuscated DLL payloads, process injection, defense evasion, shadow-copy deletion, and file encryption using **ChaCha** with **RSA-2048**, while the malware avoided systems configured for several CIS-region languages. Egregor was linked to attacks on organizations including **GEFCO, Barnes & Noble, and Ubisoft**, and operated a public leak site—described by some researchers as a **“Hall of Shame”**—to pressure non-paying victims.
Aug 15, 2026
Romanian authorities arrested two suspected **Sodinokibi/REvil** affiliates as part of **Operation GoldDust**, a multinational law-enforcement campaign targeting operators tied to both REvil and **GandCrab**. Europol said the suspects were linked to roughly **5,000 infections** and about **€500,000** in ransom payments, while the broader group of arrested affiliates was suspected of around **7,000 infections** and demands exceeding **€200 million**. Since February 2021, authorities in 17 countries, working with **Europol**, **Eurojust**, and **INTERPOL**, had arrested seven suspects connected to the two ransomware families, including a REvil affiliate associated with the **Kaseya** supply-chain attack and other suspects detained in South Korea and Kuwait. The arrests followed wider pressure on REvil’s ransomware-as-a-service operation after its infrastructure was disrupted and its public-facing sites went offline. Reporting indicated the gang shut down after **U.S. Cyber Command** hijacked one of its sites and the operators realized they had been compromised, adding to the strain from coordinated international investigations. Europol said private-sector partners including **Bitdefender**, **KPN**, and **McAfee Enterprise** supported the operation with technical analysis and decryptors distributed through **No More Ransom**, enabling more than **50,000 decryptions**, helping over **1,400 companies** recover from REvil infections, and preventing losses worth hundreds of millions of euros.
Jun 29, 2026