Recent international efforts against the notorious Evil Corp cybercrime syndicate and its affiliates have intensified, resulting in multiple arrests, new sanctions, and the exposure of key figures involved in ransomware attacks. The U.S. Department of Justice unsealed an indictment against Aleksandr Ryzhenkov, a key member of Evil Corp and an identified LockBit affiliate, for deploying BitPaymer ransomware against U.S. companies since 2017. Ryzhenkov, along with other individuals, has been sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC), prohibiting transactions with them and freezing their assets. These sanctions extend to entities associated with Evil Corp, such as Vympel-Assistance LLC and Solar-Invest LLC, owned by Eduard Benderskiy, a former Russian intelligence officer linked to the group. Evil Corp, known for its creation of the Dridex banking Trojan and various ransomware strains, has been active for over a decade, targeting financial institutions globally. Despite previous sanctions in 2019, the group adapted its tactics, using ransomware variants like DoppelPaymer and WastedLocker to evade detection. The group’s deep ties to Russian intelligence, facilitated by figures like Benderskiy, have provided them with protection from Russian authorities. This week’s actions also include the arrest of a suspected LockBit developer in France, two (2) alleged money launderers in the U.K., and a bulletproof hosting service administrator in Spain. These moves are part of Operation Cronos, which aims to dismantle the infrastructure supporting ransomware operations. The coordinated international response involving the United States, United Kingdom, and Australia, underscores the ongoing commitment to disrupt the activities of cybercriminal groups. By targeting the individuals and infrastructure behind these operations, authorities hope to mitigate the impact of ransomware on critical infrastructure and protect citizens from cyber threats.