The State Police detained a 22-year-old man suspected of cyberattacks on at least two Latvian companies for extortion purposes. The investigation believes he was automatically searching for vulnerabilities, stealing data, and demanding money for their non-disclosure.
The State Police reported the detention of a man born in 2003, who is suspected of a series of cyberattacks on Latvian companies. According to the investigation, the perpetrator gained unauthorized access to databases, copied the information contained in them, and then demanded money for not publishing it.
According to the police, the detention took place on September 15.
The investigation linked two attacks
The first episode being investigated by law enforcement occurred in February of this year. The second attack, with a similar method of execution, was recorded in early September — its target was TSC, a company that is part of the LMT group and specializes in the repair of household appliances and smart devices.
According to the police, as a result of the cyberattack, the perpetrator gained access to some personal data of clients and attempted to extort money for their non-disclosure.
At the same time, the investigation has data that the stolen information was not transferred to third parties.
How the suspect operated
The investigation was conducted by the 1st Department of the Cybercrime Combat Division of the State Police.
According to the investigation, the suspect used an automated tool that independently searched for vulnerabilities on various websites.
After discovering weak points, he gained access to databases, exported the information contained in them, and then contacted companies through specially created anonymous email accounts, demanding money for the non-disclosure of the stolen data.
To hide his location, the man, according to the police, used virtual anonymization tools.
Cybersecurity specialists helped
The suspect was identified after analyzing the attack on the TSC website, conducted with the participation of the LMT security service and CERT.LV specialists.
The data obtained allowed investigators to link both incidents, identify the alleged perpetrator, and determine his location.
During the detention, police officers also conducted a search at one of the addresses in Riga.
New episodes are being investigated
During investigative actions, evidence was seized that, according to the investigation, may indicate the detained person's involvement in other cyberattacks against companies both in Latvia and abroad.
The verification of these episodes is ongoing.
The investigation also concluded that the suspect did not select specific companies in advance, but scanned internet resources en masse in search of vulnerabilities.
Police appealed to companies
In connection with the investigation, the State Police urged businesses to check the security of their information systems, eliminate possible vulnerabilities, and ensure that necessary protective measures against cyberattacks are in place.
Criminal cases are being investigated against the detainee under articles providing for liability for unauthorized access to automated data processing systems, extortion, and illegal actions with information committed for selfish motives.
At the same time, the State Police reminds that no one is considered guilty until their guilt is proven in the established legal manner.
The investigation continues and does not rule out that the number of episodes related to the activities of the detained person may increase.
Leave a comment