International hacker network in West Germany exposed Russia bans Threema and other well-known courier services

Like a “double spider”, the hacker group caused fear and terror, and now investigators from the West German state of North Rhine-Westphalia are said to have caught them.

According to their own statements, they have identified the suspected masterminds of the international network of cybercriminals responsible for spectacular hacker attacks worldwide.

Arrest warrants had been issued against three suspects and eight others were being investigated, investigators from the Düsseldorf criminal investigation department and the prosecutor’s office reported on Monday. They are between 32 and 41 years old. Europol and the FBI were involved in the investigation. The suspects are accused of, among other things, the attack on the Düsseldorf University Hospital, the German media group Funke and the East German district of Anhalt-Bitterfeld. The latter had therefore declared a disaster.

One of the suspects, a 41-year-old Russian, is also wanted by the FBI, who have offered him a $5 million reward. The group is accused of more than 600 attacks on institutions worldwide, causing significant damage.

Connections with Russia

The criminal group called “Double-Spider” or “Grief” (grief) has connections to Russia, but there is no evidence of state actors behind the machinations. According to the German detectives, the suspects wanted a ransom of millions.

“In the case of individuals in this group of perpetrators, we also see references and connections to the Russian domestic secret service FSB and the paramilitary mercenary group Wagner,” said North Rhine-Westphalia’s interior minister Herbert Reul. Even if the acts served personal enrichment, it is reasonable to assume that they were at least tolerated by the state. In addition, it cannot be ruled out that the skimmed data and money will also be used for government purposes.

The three suspects Igor T. (41), Irina Z. (36) and Igor G. (32) are now wanted worldwide. You are now on Europol’s “Europe’s most wanted” list. It is unclear where the trio currently resides. “The attacks on critical infrastructure are a game of life and death,” said a Europol spokesperson in Düsseldorf.

“Such cybercriminals do not stop at university clinics,” says LKA boss Ingo Wünsch. “Companies need to secure their digital ports.” In the case of the Düsseldorf University Hospital, for example, there was a suspicion that the hackers could be responsible for the death of a patient. Ultimately, however, this was not confirmed.

Despite the war, the police in Ukraine actively supported the investigation, the detectives report. There and in Germany there were house searches and interrogations last week.

Attacks on more than 37 institutions

In Germany, the group has attacked and damaged at least 37 institutions. An undeclared number can be assumed because there are still companies that pay the ransom without the involvement of the police. In 2021, the international investigations against the group were taken over in North Rhine-Westphalia. A shadow economy came to light.

There are job opportunities and headhunters for hackers. So-called access brokers tackle unsafe places in company networks. Hacker attacks would also be offered to third parties as criminal services. The whole thing is handled through money laundering networks with cryptocurrencies.

In addition to the three suspects mentioned, eight others from Germany, Russia, Moldova and Ukraine are being investigated. 13 EU countries are affected. They are wanted for particularly serious extortion and computer sabotage.

Prosecutor Markus Hartmann said it was now possible to prove concrete actions against specific people. The digital traces were compressed enough for arrest warrants. “The term hacker attack is actually a trivialization of what happened.” You’re dealing with structured organized crime.

The international investigation now makes it more difficult for the suspects to spend their money in Paris, London or Milan, for example. The suspects had developed software from well-known hacker groups such as the Evil Group or Dridex and used it to attack companies themselves, reports LKA researcher Dirk Kunze. «Double-Spider», literally translated as double spider, is the English term for the crankset as part of the pedal mechanism on the bicycle.

One of the progenitor groups is believed to be responsible for the assault on Britain’s national healthcare system. In this case, the research group “Parker” made almost 100 requests for legal aid, including to Russia. She now hopes for information about the whereabouts of the suspects. (sda/dpa)