Ukrainian Hacker Arrested for Massive Cryptojacking Scheme

Europol has announced the arrest of a 29-year-old Ukrainian citizen suspected of orchestrating a large-scale cryptojacking operation. The suspect, whose identity has not been disclosed, allegedly exploited compromised cloud accounts to create 1 million virtual servers, which were then used for illegal cryptocurrency mining.

How the Scheme Was Uncovered

The investigation began in January 2023, when an unnamed cloud service provider discovered unauthorized access to accounts on its platform and launched an internal investigation. Over the past year, Europol, Ukrainian police, and representatives from the provider worked together to gather evidence that could help identify and locate the hacker.

Details of the Operation

According to investigators, the suspect had been active since 2021. He reportedly used automated brute-force tools to crack 1,500 passwords belonging to accounts of a subsidiary of one of the world’s largest e-commerce solution providers. After gaining access, the hacker used the compromised accounts to obtain administrative privileges and create over a million virtual machines, which were then used to mine cryptocurrency at the expense of others.

Financial Impact and Methods

The suspect is believed to have used TON cryptocurrency wallets to move his illegal earnings, with total transactions amounting to about $2 million. He now faces charges related to unauthorized interference with information systems, electronic communications, and electronic communication networks.

Cryptojacking Remains a Threat

Cryptojacking continues to be a significant issue, even though its peak occurred in 2017-2018. For example, according to a report by Sysdig, in 2022 cryptojackers earned about $1 in cryptocurrency for every $53 spent by the victim organization.