Websites Seized in Multi-national, Ransomware Takedown

The U.S. Attorney’s Office for the Northern District of Ohio filed a complaint against a defendant known as “Brain,” believed to be based in Europe, and who is responsible for building a multi-national ransomware organization known as Radar. The complaint sought injunctive relief to prevent additional attacks on victims from occurring and authorized disruption of the ransomware by disabling domain names, servers and IP addresses associated with the criminal enterprise. Related ransomware domain names and servers in the United Kingdom and Germany were also disabled in a transnational coordinated effort.

Victims include businesses and organizations located in more than three dozen countries throughout the world. Among the victims in the northern district of Ohio were a trade union and a manufacturing company.

The complaint alleges that the defendant developed a highly sophisticated and destructive form of software, known as ransomware, and used it to engage in wire fraud and unlawful interception of electronic communications. This was accomplished by infecting victims’ computers which locked them out from accessing their own files. Ransomware administrators then demanded the victims to pay a ransom in order to unlock the files. Failure to pay the ransom could result in selling the victims’ data to nefarious third parties.

According to the FBI, monetary losses incurred by individuals and organizations are estimated to be in the millions. This is an ongoing investigation and the extent of the reach and damage inflicted is yet to be determined.

This case was investigated by the FBI Cleveland Division; the Bavarian State Criminal Police Office in Germany; the National Crime Agency of the United Kingdom; and the Prosecutor’s Office of Bamberg, Germany.

The case is being handled by Assistant U.S. Attorney Brendan Barker for the Northern District of Ohio.

To report ransomware attacks, visit ic3.gov or call 1-800-CALL-FBI (1-800-2255-324).