A 33-year-old Ukrainian man suspected of providing access to corporate networks for the notorious Ryuk hacking group has been extradited to the United States. The arrest was made possible thanks to an international investigation that has been ongoing since 2023 and was initiated by the FBI.
The detainee, who has not been named, was arrested in April 2025 in Kyiv at the request of the Federal Bureau of Investigation. He is suspected of scanning victims’ corporate networks to identify vulnerabilities through which other Ryuk members later introduced malware, stole data and launched ransomware. It was his technical actions that allowed hackers to quickly penetrate the internal systems of companies in France, Norway, Germany, Canada, the United States and other countries.
The investigation by the Ukrainian cyber police and international partners also covered the activities of the LockerGoga, MegaCortex, Hive and Dharma groups. In total, according to official information, several participants associated with various criminal cyber networks were identified and arrested.
Ryuk was active from 2018 to 2020, especially during the COVID-19 pandemic, and became notorious for attacks on hospitals and critical infrastructure organizations. In 2020, the group rebranded itself as Conti, an even more aggressive and large-scale cybercriminal structure. Conti officially ceased operations in 2022, but its remnants still operate as autonomous groups. According to researchers, Ryuk earned about $ 150 million in cryptocurrency through ransoms from victims.
This case is yet another confirmation that international cooperation in the field of cybersecurity produces real results. Despite the complexity of the transnational nature of crimes, cybercriminals can no longer feel safe, even in countries where extradition has traditionally not been carried out. The US continues to actively pursue those involved in the crimes, even though several years have passed since they were committed.
