{
	"id": "5a1aafb2-6630-4fea-8196-7625741dc268",
	"created_at": "2026-04-06T00:11:27.295396Z",
	"updated_at": "2026-04-10T03:24:29.794313Z",
	"deleted_at": null,
	"sha1_hash": "3cada526241e2d2d8c324b396e703422b27e9419",
	"title": "Police arrest Conti and LockBit ransomware crypter specialist",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2480427,
	"plain_text": "Police arrest Conti and LockBit ransomware crypter specialist\r\nBy Bill Toulas\r\nPublished: 2024-06-12 · Archived: 2026-04-05 19:17:45 UTC\r\nThe Ukraine cyber police have arrested a 28-year-old Russian man in Kyiv for working with Conti and LockBit ransomware\r\noperations to make their malware undetectable by antivirus software and conducting at least one attack himself.\r\nThe investigation was backed by information shared by the Dutch police who responded to a ransomware attack on a Dutch\r\nmultinational, followed by data-theft extortion.\r\nThe man was arrested on April 18, 2024, as part of the 'Operation Endgame' law enforcement operation that took down\r\nvarious botnets and their main operators.\r\nhttps://www.bleepingcomputer.com/news/security/police-arrest-conti-and-lockbit-ransomware-crypter-specialist/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/police-arrest-conti-and-lockbit-ransomware-crypter-specialist/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nAs the Conti ransomware group used some of those botnets for initial access on breached endpoints, evidence led\r\ninvestigators to the Russian hacker.\r\nThe Ukrainian police reported that the arrested individual was a specialist in developing custom crypters for packing the\r\nransomware payloads into what appeared as safe files, making them FUD (fully undetectable) to evade detection by the\r\npopular antivirus products.\r\nThe police found that the man was selling his crypting services to both the Conti and LockBit cybercrime syndicates,\r\nhelping them significantly increase their chances of success on breached networks.\r\nThe Dutch police confirmed at least one case of the arrested individual orchestrating a ransomware attack in 2021, using a\r\nConti payload, so he also operated as an affiliate for maximum profit.\r\n\"As part of the pre-trial investigation, police, together with patrol officers of the special unit \"TacTeam\" of the TOR DPP\r\nbattalion, conducted a search in Kyiv,\" reads the Ukraine police announcement.\r\n\"Additionally, at the international request of law enforcement agencies in the Netherlands, a search was conducted in the\r\nKharkiv region.\"\r\nEtt fel inträffade.\r\nDet går inte att köra JavaScript.\r\nAs a result of these searches, computer equipment, mobile phones, and handwritten notes were seized for further\r\nexamination.\r\nThe investigation into the programmer's activities and precise involvement in the Conti and LockBit attacks is currently\r\nunderway.\r\nThe suspect has already been charged with Part 5 of Article 361 of the Criminal Code of Ukraine (Unauthorized interference\r\nin the work of information, electronic communication, information and communication systems, electronic communication\r\nnetworks) and faces up to 15 years imprisonment.\r\nhttps://www.bleepingcomputer.com/news/security/police-arrest-conti-and-lockbit-ransomware-crypter-specialist/\r\nPage 3 of 4\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/police-arrest-conti-and-lockbit-ransomware-crypter-specialist/\r\nhttps://www.bleepingcomputer.com/news/security/police-arrest-conti-and-lockbit-ransomware-crypter-specialist/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.bleepingcomputer.com/news/security/police-arrest-conti-and-lockbit-ransomware-crypter-specialist/"
	],
	"report_names": [
		"police-arrest-conti-and-lockbit-ransomware-crypter-specialist"
	],
	"threat_actors": [
		{
			"id": "aa73cd6a-868c-4ae4-a5b2-7cb2c5ad1e9d",
			"created_at": "2022-10-25T16:07:24.139848Z",
			"updated_at": "2026-04-10T02:00:04.878798Z",
			"deleted_at": null,
			"main_name": "Safe",
			"aliases": [],
			"source_name": "ETDA:Safe",
			"tools": [
				"DebugView",
				"LZ77",
				"OpenDoc",
				"SafeDisk",
				"TypeConfig",
				"UPXShell",
				"UsbDoc",
				"UsbExe"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434287,
	"ts_updated_at": 1775791469,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3cada526241e2d2d8c324b396e703422b27e9419.pdf",
		"text": "https://archive.orkl.eu/3cada526241e2d2d8c324b396e703422b27e9419.txt",
		"img": "https://archive.orkl.eu/3cada526241e2d2d8c324b396e703422b27e9419.jpg"
	}
}