Ransomware gang behind Utility, CSX attacks feels heat in Ukraine

Police arrest 6 alleged members of Clop, shut down infrastructure

Ukrainian and South Korea police at the home of an alleged member of the Clop ransomware gang. (Photo: National Police of Ukraine)

Ukrainian police have dealt a serious blow to the ransomware gang behind the cyberattacks in the U.S. transportation and logistics sector  — including the trailer maker Utility and rail operator CSX — arresting six alleged members of Clop and seizing cash, computers and cars.

The National Police of Ukraine said Wednesday it made the arrests as part of an operation with U.S. and South Korean law enforcement and Interpol. Beyond nabbing the alleged cybercriminals, police said they shut down the infrastructure used to stage the attacks. 

Clop’s attacks have cost its victims about $500 million, police said. The hackers targeted companies across the world — and publicly acknowledged many of its attacks through a leak site. It extorted companies through their initial attacks and the threat of leaking stolen data. 

Footage of Ukrainian and South Korea police raiding the homes of alleged members of the Clop ransomware gang.

The ransomware gang attempted to extort California-based Utility Trailer Manufacturing in May by leaking 5 gigabytes of stolen data to the dark web. In March, Clop took a similar approach with CSX Corp. (NASDAQ:CSX), leaking data that included personal information about current and former employees.

Clop also targeted Canadian fuel distributor Parkland. In addition, it claimed that it attacked Canadian trucking firm Boutin Express and Minnesota truck dealership Allstate Peterbilt, though neither company responded to requests for comments about the apparent attacks. 

It’s unclear if the operation, which included 21 raids in Ukraine’s capital, Kyiv, succeeded in shutting down Clop. The group’s dark web leak site was still online as of Wednesday morning.

It comes as international law enforcement turns on the heat on the criminals behind ransomware attacks. Last week, the U.S. Department of Justice announced it had seized most of the ransom paid to members of DarkSide by Colonial Pipeline. 

Click for more FreightWaves articles by Nate Tabak

Upcoming FreightWaves Events
Compliance

Brokerage Compliance Symposium

The day before F3. Every compliance issue you face - fraud exposure, carrier liability, FMCSA rules, cargo theft, insurance gaps - navigated by attorneys and operators defining best practices in a changing industry.

October 26, 2026
The Signal at Chattanooga Choo Choo • Chattanooga, TN
Register Now
Awards

F3 Awards Dinner

The night before F3. FreightTech100 companies honored. FreightTech 25 and Shipper of Choice winners revealed live. Cocktail reception into dinner and live music - 300 industry leaders in one purpose-built room.

October 26, 2026
The Signal at Chattanooga Choo Choo • Chattanooga, TN
Register Now
FreightTech

F3: Future of Freight Festival

Industry-defining keynotes, rapid-fire technology demos, and industry leaders networking in experiences across Chattanooga - plus the inaugural F3 Awards Dinner featuring the FreightTech and Shipper of Choice reveals.

October 27, 2026 – October 28, 2026
The Signal at Chattanooga Choo Choo • Chattanooga, TN
Register Now
Compliance Brokerage Compliance Symposium Oct 26 • The Signal at Chattanooga Choo Choo • Chattanooga, TN

The day before F3. Every compliance issue you face - fraud exposure, carrier liability, FMCSA rules, cargo theft, insurance gaps - navigated by attorneys and operators defining best practices in a changing industry.

The Signal at Chattanooga Choo Choo • Chattanooga, TN Register Now
Awards F3 Awards Dinner Oct 26 • The Signal at Chattanooga Choo Choo • Chattanooga, TN

The night before F3. FreightTech100 companies honored. FreightTech 25 and Shipper of Choice winners revealed live. Cocktail reception into dinner and live music - 300 industry leaders in one purpose-built room.

The Signal at Chattanooga Choo Choo • Chattanooga, TN Register Now
FreightTech F3: Future of Freight Festival Oct 27 – Oct 28 • The Signal at Chattanooga Choo Choo • Chattanooga, TN

Industry-defining keynotes, rapid-fire technology demos, and industry leaders networking in experiences across Chattanooga - plus the inaugural F3 Awards Dinner featuring the FreightTech and Shipper of Choice reveals.

The Signal at Chattanooga Choo Choo • Chattanooga, TN Register Now