Romanian law enforcement agents have arrested a threat actor who is tied to various ransomware attacks for suspected computer hacking and theft of information from numerous top-tier company networks in the retail, energy, and utility sectors. The DIICOT (Romanian Directorate for Investigating Organized Crime and Terrorism) arrested the 41-year-old threat actor in his home in Craiova on counts of blackmail, unauthorized transfer of computer data, illegal interception of computer transmissions, and unauthorized access to computer systems. Tactics of the threat actor fit closely to the majority of ransomware actors where they would compromise a targeted network, steal sensitive information such as financial information & employee records, then hold it for a significant payment to release the data back to the victim as well as their network(s). Specifically, this threat actor stole personal identifiable information (PII) including customer information, sensitive employee information, and company financial documentation. The ransomware affiliate that the threat actor is tied to is currently unknown, however based on recent additional arrests of GranCrab and REvil affiliates researchers believe that the individual may have significant ties to some operations from these groups. CTAPT will continue to monitor any developments and provide updates accordingly.