The attacks are believed to have affected nearly 2000 victims in 71 countries. The cyber actors are known for specifically targeting large corporations, effectively bringing their business to a standstill.

Ransom notes demanded victims pay the attackers in Bitcoin in exchange for decryption keys. 

A number of the individuals are suspected of being in charge of laundering the ransom payments. They would funnel the Bitcoin ransom payments through mixing services, before cashing out the ill-gotten gains. 

The operation took place on 26 October in Ukraine and Switzerland. Most of the suspects are considered high-value targets because they are being investigated in multiple high-profile cases in different jurisdictions.

Authorities from Norway, the United Kingdom, France, the Netherlands, Ukraine, Germany, Switzerland and the United States were involved in the operation.

More than €26.7 million in cash and virtual currencies was seized in the operation, as well as 234 kg of drugs and 45 firearms. 

This operation, known as Dark HunTOR, was composed of a series of separate but complementary actions in Australia, Bulgaria, France, Germany, Italy, the Netherlands, Switzerland, the United Kingdom and the United States.

The U.S. Department of Justice, U.S. Deputy Attorney General Lisa O. Monaco and Assistant Attorney General Kenneth A. Polite Jr. of the Criminal Division published statements on the operation.

The criminal network was organised in a pyramid structure, which included different specialised areas and roles. Among the members of the criminal group were money laundering experts, including experts in cryptocurrencies. 

The suspects defrauded hundreds of victims through phishing attacks and other types of online fraud such as SIM swapping and business email compromise before laundering the money through a wide network of money mules and shell companies. Last year, the illegal profit was estimated at around € 10 million.

The criminal network created different trading online platforms advertising substantial profits from investments in high-risk options and cryptocurrencies.

In total, the criminal network defrauded victims across Europe of an estimated €30 million.

Eurojust, the EU’s Judicial Cooperation Unit, and Europol, the EU Agency for Law Enforcement Cooperation, announced that six people have been arrested following a 14-month joint investigation with the UK's South West Regional Cyber Crime Unit, the Dutch Police and the UK's National Crime Agency.

The five men and one woman are suspected of targeting users' bitcoin tokens, affecting at least 4,000 victims in 12 countries, but these numbers are expected to rise.

The suspects were arrested simultaneously in Charlcombe, Bath, Trowbridge, UK, and Amsterdam and Rotterdam, the Netherlands.

The agencies said that the investigation relates to "typosquatting", where a "well-known online cryptocurrency exchange is 'spoofed', or recreated to imitate a genuine site to gain access to victims' bitcoin wallets, their login Details and funds.

The two agencies said:

"The arrested criminals are suspected of having committed computer misuse act offences and money laundering."

This case was referred to the European Cybercrime Centre and the Joint Cybercrime Action Taskforce hosted at Europol after the British authorities identified possible suspects living in the Netherlands.

Operational support delivered by European Cybercrime Centre since February 2018 allowed the Joint Cybercrime Action Taskforce to co-ordinate the international co-operation between the different EU Member States involved.