Europol Dismantles Major Ransomware-as-a-Service Operation in Multi-Country Raid

Europol has announced the successful takedown of "DarkVault," one of the largest ransomware-as-a-service operations currently active, resulting in 12 arrests across 5 European countries and the seizure of servers hosting over 300 decryption keys that will be made available to victims.

The operation, codenamed "Operation Shadow Strike," involved coordinated raids in Romania, Ukraine, Poland, Netherlands, and Germany. Law enforcement seized 47 servers, $8.3 million in cryptocurrency, luxury vehicles, and extensive documentation of the criminal network's operations.

DarkVault had been operating since mid-2024 and was responsible for attacks on over 450 organizations worldwide, generating an estimated $180 million in ransom payments. The group's affiliates targeted sectors including manufacturing, logistics, legal services, and education.

Europol's European Cybercrime Centre (EC3) coordinated the investigation with support from the FBI, UK National Crime Agency, and cybersecurity firms Recorded Future and Group-IB, who provided crucial threat intelligence.

The seized decryption keys are being processed and will be distributed through the No More Ransom project. Victims who paid ransoms may be eligible for restitution from seized assets. This takedown represents the third major RaaS disruption in the past 12 months.