Authorities have located and arrested twelve (12) individuals in an international law enforcement operation who are believed to have orchestrated numerous ransomware attacks on critical infrastructure. These threat actors targeted large organizations across seventy-one (71) countries, totaling over 1,800 victims since 2019. The arrests occurred last week in Ukraine and Switzerland alongside the seizure of numerous electronic devices, five (5) luxury vehicles, and over $50,000 in cash. The suspects are believed to have significant ties to the “LockerGoga”, “Dharma”, and “MegaCortex” ransomware and were responsible for laundering the ransomware payments through several services and cashing them out accordingly. In addition, several suspects were working on development and fine tuning their brute force attacks, SQL injections, and their phishing campaign payloads. Once compromised, these individuals would lead the charge in dropping additional malicious scripts onto the victim’s network paired with lateral network movement. The law enforcement operation that arrested these individuals is built up of authorities from the United States, United Kingdom, Ukraine, Norway, and more. CTAPT will continue to follow this operation and note any additional arrests or findings and provide updates accordingly.