The Korean Police Agency said it has received domestic arrest warrants and requested Interpol to issue a “red notice” for the two suspects in an effort to bring them to South Korea.
South Korean authorities did not publicly release the name or further information on the two suspects for whom they requested the Interpol notice, except that one is a Ukrainian national.
The suspect was among six people detained by Ukrainian police in June, when South Korean and US authorities joined in raids on the homes of suspects affiliated with the Clop ransomware syndicate in Kyiv and elsewhere.
The police operations targeted alleged associates of a Russian-speaking ransomware gang blamed for a half billion dollars in damages in cyber-attacks that scramble data and can only be stopped with a software key obtained by paying the criminals.
The most potent ransomware gangs operate with Kremlin tolerance, based out of reach of Western law enforcement.
Russian authorities neither prosecute nor extradite them.
A South Korea police statement said the suspects detained in Ukraine in June allegedly collaborated with a hacking organisation and laundered the virtual currency they obtained through the ransomware and converted them for cash.
Earlier this month, South Korean police decided to take steps to have three of those earlier detained in Ukraine, and another person whose nationality they refuse to disclose, charged with violating South Korea’s laws on communication networks and information protection, extortion and concealing criminal proceeds.
South Korea is now looking to extradite what it says are the two suspects of that group who played a leading role in the cyber-attacks, said Choi Jongsang, chief of cyber crime investigation division at the Korea police agency.
Bringing them to South Korea still may not be easy.
A Ukraine law doesn’t allow local criminal suspects to be extradited to a foreign country and the legal status and whereabouts of one of the suspects isn’t known, Mr Jongsang said.
He said three companies and a university in South Korea were hit by the ransomware attacks in 2019 and that they were extorted to pay a Bitcoin ransom equivalent to $5.1 million in cash in total.
An earlier Ukraine police statement said the gang also targeted US universities, including Stanford Medical School and the University of Maryland.
South Korean police said they’ll continue an investigation to the get to the bottom of the hacking group responsible for the cyber-attacks.
Police didn’t identify where that organisation is based and where its hackers are from.