Phuket police arrest four Russian nationals accused of running crypto-ransomware attacks

Law enforcement in Phuket has arrested four hackers suspected of orchestrating ransomware attacks on Swiss firms and stealing millions in cryptocurrency.

The accused, all Russian nationals, reportedly deployed ransomware on the networks of 17 Swiss companies between April 2023 and October 2024, a Feb. 10 report from local media outlet The Nation Thailand said.

For those unaware, ransomware attacks involve hackers locking up a victim’s data and demanding a payout—usually in crypto—to restore access. In this case, the hackers allegedly used the Phobos malware, the report added.

The accused were reportedly part of the Russian ransomware group 8Base and were also responsible for stealing approximately $16 million worth of Bitcoin from around 1,000 victims worldwide.

According to Pol Lt Gen Trairong Phiewphan, commissioner of the Cyber Crime Investigation Bureau, the suspects were wanted by both U.S. and Swiss authorities. 

Thai police, in coordination with immigration officials, tracked them down in Phuket and seized over 40 items of evidence, including laptops, smartphones, and digital wallets. Switzerland has already requested their extradition to face charges.

Meanwhile, Phuket has become the center of multiple cryptocurrency-related crimes over the past months.

Last month, a Russian man was assaulted and robbed of $20,000 in a hotel in Karon, Phuket, in what authorities described as a crypto-related dispute turned violent. According to reports, the victim was confronted by two Russian associates over an unsettled cryptocurrency debt linked to prior business dealings in Russia.

In November 2024, a Ukrainian national in Phuket was forced to transfer $250,000 worth of Tether while visiting friends. Local reports stated that the victim was tied up with cables and coerced into making the transaction before the assailants fled.