Ukraine and Germany target alleged Black Basta hackers in raids

Ukrainian and German authorities said on Thursday they identified suspects associated with the Russia-linked ransomware group Black Basta, and have now started an international manhunt for more perpetrators. 

According to the official website of Ukraine’s cyber police unit, two Ukrainian nationals were revealed as active members of the group, with an unnamed Russian citizen as the alleged organizer. That individual has been placed on an international wanted list through Interpol, German authorities confirmed.

The actions came through a joint investigation by Ukraine, Germany, Switzerland, the Netherlands, and the United Kingdom. Europol, which was also part of the supporting agencies in the probe, said Black Basta is one of the most dangerous cybercrime operations in recent years.

Russian-based ransomware network involved in years of cyberattacks 

According to Ukraine’s investigative unit, Black Basta has been active since at least early 2022. The group is accused of launching ransomware attacks against corporations, hospitals, and public institutions in Western countries it considers “economically viable.”

The group supposedly caused damages estimated in the hundreds of millions of euros between 2022 and 2025 on industrial and healthcare organizations in Europe and the United States, and distributed private information to hacking networks.

The two Ukrainian suspects had mounted their base in western Ukraine, working with other hackers to breach the security of corporate systems and extract login credentials. After obtaining employee authorization data, they used it to enter internal company systems and expand admin privileges and access to company files.

The stolen access was used to disable critical systems, and malicious software was deployed to encrypt data for the attackers to demand ransom in exchange for restoring access.

Raids in western Ukraine uncover digital and crypto evidence 

As reported by the Ukrainian police, authorized searches were carried out at residences in the Ivano-Frankivsk and Lviv regions, suspected to have been where the cyber criminals lived. During the raids, officers seized crypto, although they did not disclose the value or type of digital assets seized.

The authorities had previously conducted searches at the request of foreign partners in Kharkiv and surrounding areas, which targeted other suspected group members. The German investigations team believes a Russian national founded and led the group, and he was part of another notorious ransomware and cyber-extortion operation.

At the request of Germany’s Federal Criminal Police Office and Frankfurt prosecutors, Interpol channels were used to issue the wanted notice. 

“Black Basta as a top-tier cybercrime threat, Law enforcement agencies from multiple countries and a significant threat to global cybersecurity,” Ukraine cyber police wrote in its statement.

Concluding its report on the case, the agencies reiterated that no single country could dismantle such networks alone and urged more nations to open doors for sharing intelligence reports.

Ukraine and Russia’s crime syndicate extends to Austria

Almost two months ago, Austrian police arrested two suspects linked to a fatal crypto robbery, identified as Ukrainian men aged 19 and 45. 

The victim was a 21-year-old Ukrainian national whose body was discovered burnt shortly after midnight hour mark of November 26. The remains were found inside a burned Mercedes with Ukrainian license plates in the Donaustadt district of Vienna.

When emergency responders arrived at the scene, they found the charred vehicle, but forensic police later recovered a melted gasoline canister from the back seat.

Per the reports of local news outlets, the crime began earlier that night near the SO/Vienna hotel at an underground parking garage. Security footage showed a confrontation between the victim and two men, with witnesses reporting a loud exchange of words in the garage. 

A hotel guest contacted the front desk, who then alerted police, but officers got there well after the individuals had already left the scene. The victim was supposedly forced into his own vehicle and driven to the Donaustadt district. He was then assaulted and forced to surrender passwords to two cryptocurrency wallets that were later emptied. 

Austrian media reported the victim suffered severe injuries during the assault and died before the vehicle was set on fire.

Want your project in front of crypto’s top minds? Feature it in our next industry report, where data meets impact.