Thai Police Arrest Four Russians for Crypto Ransomware Attack on Swiss Companies

In a coordinated international effort, Thai law enforcement in Phuket detained four Russians suspected of conducting crypto ransomware attacks on Monday.

These suspects are believed to be part of the 8Base group, known for utilizing Phobos ransomware to extort victims.

Arrests of Russian Nationals in Thailand

On February 10, a local media outlet revealed that the suspects, all Russian nationals, used ransomware to attack 17 Swiss companies between April 2023 and October 2024.

Earlier today we made a post regarding the arrest of 8base ransomware group. We have deleted that post due to misinformation. This is a correction post.

Note: Our original source of the 8base ransomware group takedown was incorrect. Thank you to "Deleted Account" (their name,… pic.twitter.com/nQgiR3dFQ4

— vx-underground (@vxunderground) February 11, 2025

The arrests resulted from collaboration among agencies from 14 countries, leading to the dismantling of 27 servers associated with the criminal network.

Europol stated, “A coordinated international law enforcement action last week has led to the arrest of four individuals leading the 8Base ransomware group.”

The detained individuals are accused of infiltrating the networks of multiple European companies, encrypting data, and demanding cryptocurrency payments for decryption.

Phobos ransomware often targets small to medium-sized businesses lacking robust cybersecurity measures.

Beyond these incidents, the suspects are linked to approximately 1,000 victims worldwide, and around $16 million in Bitcoin was stolen.

The 8Base group has been identified as a key player in the crypto ransomware ecosystem. It utilizes sophisticated methods to breach systems and extort funds.

The suspects are currently awaiting extradition to face charges related to their alleged involvement in the ransomware attacks.

International Collaboration and Ongoing Efforts Against Crypto Ransomware

This operation highlights the importance of international collaboration in combating crypto ransomware.

The arrests in Phuket were part of a broader initiative involving multiple countries and agencies, highlighting the global nature of cyber threats and the necessity for coordinated responses.

Recall that the joint operation of the Thai and Chinese authorities led to the recent arrest of two Chinese scammers, with $2.5 million in USDT seized from them.

Meanwhile, Phuket has recently been a focal point for cryptocurrency-related criminal activities.

🇹🇭 $250K in USDT stolen during a violent Thailand crypto theft, reflecting the global rise in crypto crimes.#ThailandCrypto #CryptoSecurityhttps://t.co/8CsWwQKhOf

— Cryptonews.com (@cryptonews) November 11, 2024

In November 2024, a Ukrainian national was coerced into transferring $250,000 worth of USDT while visiting friends in Phuket.

Earlier in the year, Thai police launched a search for the Russian suspects after they assaulted and robbed another Russian of $20,000 in a hotel in Karon, Phuket, over a cryptocurrency dispute.

These cross-border arrests reveal a sophisticated web of cybercrime that challenges the security of our digital assets.

As international teams dismantle these networks, investors and business leaders are compelled to reassess how they protect their financial interests amid shifting risks.

In a moment marked by uncertainty, how will you adjust your strategies to ensure your investments remain secure?