Police in Ukraine and Germany have raided homes linked to suspected members of the Black Basta ransomware group as part of an international investigation into the network’s operations. Authorities said the searches were carried out to gather evidence and disrupt activity linked to ransomware attacks.
Ukrainian law enforcement searched properties in Ivano Frankivsk and Lviv and identified two Ukrainian nationals suspected of involvement in the group. Prosecutors stated that the suspects were linked to technical work used to support cyber intrusions, including password recovery methods that can aid attackers in gaining access to victim networks. Officers seized electronic devices and other materials for forensic examination.
German prosecutors stated that the investigation is focused on identifying individuals involved in various stages of ransomware attacks, from initial access to extortion. Authorities said the raids were coordinated through cross-border cooperation and are part of a broader effort to dismantle ransomware operations targeting organisations in multiple countries.
German officials have also issued an arrest warrant for a Russian national described as a key figure in the Black Basta network. Prosecutors said the suspect is accused of organising attacks, selecting targets, coordinating activity, and managing ransom negotiations. Authorities said the individual has been placed on international wanted lists.
Black Basta is a ransomware operation that has targeted organisations across multiple sectors. Authorities said the group has been linked to a large number of incidents, including cases involving disruption to business operations and demands for payment in exchange for decryption and non-disclosure of stolen data.
Officials said the investigation remains active and further actions may follow as evidence is analysed.