Ransomware gang busted in Thailand hotel raid

In a dramatic raid at a hotel in central Pattaya this week, Thai police have unearthed a criminal gang that was operating a ransomware and illicit gambling operation.

At 11:30pm local time on Monday 16 June, authorities conducted a floor-by-floor search of the eight-storey Antai Holiday Hotel, after it had been tipped off about suspected illegal activity.

What they found was not only a floor housing a sophisticated gambling operation with poker tables, large quantities of cash chips, and some 20 foreign gamblers, but also - on the eighth floor - six Chinese nationals who were distributing links to companies designed to infect them with ransomware.

Thai police say that the six men apprehended on the hotel's top floor were employees of the gang, specifically paid to try to infect Chinese companies with ransomware. Nine laptops and 15 mobile devices were seized by the authorities from the men.

There is currently a near-blanket ban on gambling in Thailand, with the exception of betting on horse races and the government-sponsored lottery.

In all, Pattaya police say that at least 20 foreigners were arrested during the raid - most of them were identified as Chinese, but others hailed from Vietnam, Singapore, Cambodia, and Myanmar.

In a photograph released by police, officers could be seen stood behind some of those apprehended, who were sat cross-legged with heads bowed behind some of the seized computers and mobile phones.

The arrests must have come as a shock to other residents of the hotel. Guests on other floors may well have been entirely unaware of the illegal activities taking place just a few metres away.

Perhaps not unsurprisingly, when I visited a hotel booking site to see if I could reserve a room at the Antai Holiday Hotel, I was told that it was not taking reservations at the moment.

If convicted, the suspects will be deported to their home countries and permanently barred from re-entering Thailand, according to media reports.

It is clear that cybercrime does not operate in isolation. Whereas once digital crime might have been primarily the province of teenagers working on their own in the basement, increasingly ransomware and other cybercrime operations are merging with more "traditional" forms of organised criminality - such as gambling rings, money laundering, drug smuggling, and gambling rings.

As a result, law enforcement raids can turn up not just hard drives and cryptocurrency wallets, but also poker chips, fake passports, burner phones, and databases of stolen identities.

If you're going to holiday in Pattaya, Thailand, in the immediate future you may wish to check that your hotel plans have not become a crime scene.