Moldova arrests suspect in ransomware attacks targeting Dutch firms

Avatar

Moldovan authorities have arrested a 45-year-old man suspected of involvement in a series of ransomware attacks targeting Dutch companies in 2021.

The suspect, who is internationally wanted for cybercrime-related offenses including blackmail and money laundering, was detained last week following a search of his residence in Moldova. Officials did not release his name but said he is a “foreign citizen.”

Moldovan police seized over 84,000 euros ($93,000) in cash, an electronic wallet, two laptops, a mobile phone, a tablet, six bank cards, and various data storage devices, officials said in a statement on Monday.

Among the attacks the suspect is allegedly responsible for is an incident targeting the Netherlands Organization for Scientific Research (NWO), which caused an estimated 4.5 million euros ($5 million) in damage.

The suspect remains in custody while Moldovan prosecutors initiate extradition procedures to the Netherlands.

The arrest comes amid a broader crackdown on cybercrime across Europe. In a separate case last week, Irish authorities sentenced a 43-year-old man to two years in prison for operating a website selling malware, ransomware and stolen financial data.

Earlier in May, Polish police detained four individuals accused of running illegal DDoS-for-hire services used to disrupt websites and servers globally.

In April, Ukrainian law enforcement dismantled a criminal group that defrauded Latvian citizens of more than $145,000 through fake cryptocurrency investment schemes run from call centers across Ukraine.

CybercrimeNewsIndustryNews Briefs
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

Airline carrying out deportation flights confirms cyberattack to SEC

Next Post

ASUS Patches DriverHub RCE Flaws Exploitable via HTTP and Crafted .ini Files

Related Posts

Qilin Ransomware Ranked Highest in April 2025 with Over 45 Data Leak Disclosures

Threat actors with ties to the Qilin ransomware family have leveraged malware known as SmokeLoader along with a previously undocumented .NET compiled loader codenamed NETXLOADER as part of a campaign observed in November 2024. "NETXLOADER is a new .NET-based loader that plays a critical role in cyber attacks," Trend Micro researchers Jacob Santos, Raymart Yambot, John Rainier Navato, Sarah Pearl
Avatar
Read More

Critical Erlang/OTP SSH Vulnerability (CVSS 10.0) Allows Unauthenticated Code Execution

A critical security vulnerability has been disclosed in the Erlang/Open Telecom Platform (OTP) SSH implementation that could permit an attacker to execute arbitrary code sans any authentication under certain conditions. The vulnerability, tracked as CVE-2025-32433, has been given the maximum CVSS score of 10.0. "The vulnerability allows an attacker with network access to an Erlang/OTP SSH
Avatar
Read More