This man, a Russian national usually living in the Czech Republic, was indicted for criminal conspiracy to commit a crime or offense and placed in pre-trial detention.
The Ragnar computer virus has affected many companies around the world since 2020. As part of an international survey on “band” of ransomware behind these attacks, a Russian national was indicted in Paris and imprisoned, the Paris prosecutor announced on Saturday October 21. This man, usually living in the Czech Republic, is “suspected of being a developer for the Ragnar group”, said Laure Beccuau, in a press release. He was indicted on Friday for criminal conspiracy to commit a crime or misdemeanor and placed in pre-trial detention.
The Ragnar virus infects companies’ computer systems, encrypts their data and then demands payment of a ransom of $5 to $70 million in exchange for the decryption key. “The Ragnar group has approximately 168 victims spread across the world,” according to the magistrate, who adds that to date, “10 French victims have been recorded.”
The fruit of international cooperation
This suspect was arrested as part of a “major operation” carried out this week by the French and German authorities, in consultation with the American and Italian authorities, and with the support of Latvia, the Czech Republic, Spain, Japan and Ukraine. Coordination meetings were held within Eurojust and Europol.
“This important step in the fight against the Ragnar ransomware group focused from a technical point of view on the identification and shutdown of a portion of the servers used by the group, in particular those dedicated to exfiltration or the publication of data”, detailed the prosecution. Six people were questioned and four searches took place. Cryptocurrencies “group members of interest” located in France, Spain, Latvia and the Czech Republic were seized.
“This operation of international scope is part of the continuity of operations carried out by France alongside the United States and Canada, having led to the arrest in Canada of Mikhail Vasiliev in October 2022, affiliated with the Ragnar group”, underlines the magistrate again.
In France, a preliminary investigation was opened in September 2020 by the section specializing in cybercrime of the Paris prosecutor’s office after an attack against a French company, the French shipowner CMA-CGM.