{
	"id": "7f63c4a9-b91d-4524-a54f-79fb7a84bdc7",
	"created_at": "2026-04-06T00:12:31.56881Z",
	"updated_at": "2026-04-10T03:20:37.329621Z",
	"deleted_at": null,
	"sha1_hash": "206b5a3e2ca0b4b0f1c61a93e449e02698b39979",
	"title": "TrickBot gang developer arrested when trying to leave Korea",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1898741,
	"plain_text": "TrickBot gang developer arrested when trying to leave Korea\r\nBy Lawrence Abrams\r\nPublished: 2021-09-06 · Archived: 2026-04-05 15:52:29 UTC\r\nAn alleged Russian developer for the notorious TrickBot malware gang was arrested in South Korea after attempting to\r\nleave the country.\r\nThe TrickBot cybercrime group is responsible for a variety of sophisticated malware targeting Windows and Linux devices\r\nto gain access to victim's networks, steal data, and deploy other malware, such as ransomware.\r\nSeoul's KBS (via The Record) first reported that a Russian man was stranded in South Korea due to COVID-19 restrictions,\r\nand his passport subsequently expired.\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nAfter waiting for over a year for his passport to be renewed, the individual attempted to depart South Korea again but was\r\narrested at the airport due to an extradition request by the USA.\r\nIt is alleged that the man worked as a web browser developer for the TrickBot operation while he lived in Russia in 2016.\r\nHowever, the Russian man claims that he did not know he worked for a cybercrime gang after getting hired from an\r\nemployment site.\r\n\"When developing the software, the operation manual did not fall under malicious software,\" the man told the Seoul High\r\nCourt.\r\nThe Russian individual's attorney is currently fighting the USA extradition attempt, claiming that the USA will prosecute the\r\nindividual unfairly.\r\n\"If you send him to the United States, it will be very difficult to exercise your right of defense and there is a high possibility\r\nthat you will be subjected to excessive punishment,\" argued the alleged TrickBot developer's attorney.\r\nLaw enforcement's siege on TrickBot\r\nThe TrickBot gang is responsible for numerous malware, including TrickBot, BazaLoader, BazaBackdoor, PowerTrick, and\r\nAnchor. All of these (malicious tools) are used to gain access to corporate networks, steal files and network credentials, and\r\nultimately deploy ransomware on the network.\r\nBoth the Ryuk and Conti ransomware operations are believed to be operated by the TrickBot gang and are known to be\r\ndeployed through their malware.\r\nDue to the enormous damage and economic loss inflicted by this gang on U.S. interests, the U.S. Cyber Command and a\r\npartnership between Microsoft and numerous security companies independently attempted to take down the gang's\r\ninfrastructure in October 2020.\r\nWhile there was some disruption of the gang's activities, the malware group quickly rebuilt its infrastructure and continued\r\nto launch new malware campaigns targeting organizations worldwide.\r\nMore recently, the U.S. Department of Justice charged a Latvian national named Alla Witte with 19 counts in a 47-count\r\nindictment for allegedly helping to develop the backend platform for a new ransomware operation.\r\nIn court documents from Witte's indictment, prosecutors shared chat logs between TrickBot gang members discussing how\r\nthey hired developers for various tasks. While some developers realized that the job involved \"black hat\" activities,\r\nconversations indicated that some developers might not have realized they were working for cybercriminals.\r\nWhile the court document does not name the ransomware operation that Witte is believed to have helped develop,\r\nBleepingComputer has been told that she worked on the recently released Diavol ransomware.\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/\r\nPage 3 of 4\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/"
	],
	"report_names": [
		"trickbot-gang-developer-arrested-when-trying-to-leave-korea"
	],
	"threat_actors": [],
	"ts_created_at": 1775434351,
	"ts_updated_at": 1775791237,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/206b5a3e2ca0b4b0f1c61a93e449e02698b39979.pdf",
		"text": "https://archive.orkl.eu/206b5a3e2ca0b4b0f1c61a93e449e02698b39979.txt",
		"img": "https://archive.orkl.eu/206b5a3e2ca0b4b0f1c61a93e449e02698b39979.jpg"
	}
}