Hacker group "INF Group" arrested: attacks on institutions in Croatia and Serbia, data sales prevented
Serbian police have arrested three members of the hacker group "INF Group" for ransomware attacks on state institutions in Serbia and Croatia. The sale of stolen data on the darknet has also been prevented.
Three hackers arrested in Serbia for attacks on Croatian and Serbian institutions
Serbian police have detained three suspected members of the hacker group "INF Group", which is linked to a series of attacks using extortion software, breaches of information systems and data theft in Serbia, Croatia and elsewhere in the region, according to Večernji list.
The operation was conducted by officers from the Service for Combating High-Tech Crime at the Directorate of Technology of the Serbian Ministry of Interior, in cooperation with the Security Information Agency and several specialised police units and departments in Belgrade and Zaječar.
Who was arrested
Detained were N. M. S. (born 2004) from Belgrade, L. D. (born 2003) from Zaječar and a seventeen-year-old from Belgrade. All three are charged with unauthorised access to protected computers, networks and electronic data processing systems. L. D. is additionally charged with computer sabotage, while the minor is suspected of extortion.
Targets of the attacks: from health fund to football association
The investigation established that the group targeted information systems of state bodies, large companies and organisations. In certain cases, the suspects allegedly managed to gain control of systems, encrypt data or extract large quantities of personal and sensitive information about citizens. Some victims were demanded ransom in cryptocurrencies on the condition that the stolen data would not be publicly released.
On the list of targets are the Republic Health Insurance Fund of Serbia, the database of public bailiffs, the records of the Serbian Ministry of Interior's Directorate for Foreigners and the Football Association of Serbia. Among the systems suspected of being attacked are the Ministry of Labour of the Republic of Croatia and the Croatian judicial system. The investigation links the group to attacks on public transport systems in Belgrade as well as information systems of several major companies throughout the region.
Data sales on the darknet prevented
The Serbian Ministry of Interior announced that timely intervention by the Service for Combating High-Tech Crime prevented the sale of compromised data from a state institution on the darknet. Simultaneously, according to the investigators' claims, several cyber attacks that had already been prepared against state and private entities in Serbia were neutralised.
During searches of the residences and premises used by the suspects, police found items suspected of having been used in the commission of criminal offences.
"Most active hacker group in the region"
Investigators describe "INF Group" as the most active and operationally successful hacker group identified in the region to date, taking into account the number of attacks and compromised systems identified so far. Serbian authorities consider this operation one of the most significant ransomware crime investigations conducted in Europe in recent years.
The investigation is ongoing. Police are working to establish all circumstances of the case, identify possible additional members or associates, and collect and secure digital evidence.
Source: Večernji list