S Korea seeks Interpol notice for two cyber gang leaders

South Korean authorities did not publicly release the name or further information on the two suspects for whom they requested the Interpol notice — except that one is a Ukrainian national.

The suspect who is a Ukrainian national was among six people detained by Ukrainian police in June, when South Korean and U.S. authorities joined in raids on the homes of suspects affiliated with the Clop ransomware syndicate in Kyiv and elsewhere. The police operations targeted alleged associates of a Russian-speaking ransomware gang blamed for a half billion dollars in damages in cyberattacks that scramble data and can only be stopped with a software key obtained by paying the criminals.

The most potent ransomware gangs operate with Kremlin tolerance, based out of reach of Western law enforcement. Russian authorities neither prosecute nor extradite them.

A South Korea police statement said the suspects detained in Ukraine in June allegedly collaborated with a hacking organization and laundered the virtual currency they obtained through the ransomware and converted them for cash.

Earlier this month, South Korean police decided to take steps to have three of those earlier detained in Ukraine, and another person whose nationality they refuse to disclose, charged with violating South Korea’s laws on communication networks and information protection, extortion and concealing criminal proceeds.

South Korea is now looking to extradite what it says are the two suspects of that group who played a leading role in the cyberattacks, said Choi Jongsang, chief of cybercrime investigation division at the Korea police agency.

Bringing them to South Korea still may not be easy.

A Ukraine law doesn’t allow local criminal suspects to be extradited to a foreign country and the legal status and whereabout of one of the suspects isn’t known, Choi said.

He said three companies and a university in South Korea were hit by the ransomware attacks in 2019 and that they were extorted to pay a Bitcoin ransom equivalent to 4.5 billion won ($3.8 million) in cash in total.

An earlier Ukraine police statement said the gang also targeted U.S. universities, including Stanford Medical School and the University of Maryland.

South Korean police said they’ll continue an investigation to the get to the bottom of the hacking group responsible for the cyberattacks. Police didn’t identify where that organization is based and where its hackers are from.