The Russian national allegedly used three well-known ransomware variants - LockBit, Babuk and Hive - to target critical infrastructure victims.
CISA warned that a ransomware group exploited vulnerable PaperCut servers in May in order to target the education facilities subsector.
The ransomware task force said in their latest progress report that private sector organizations, governments and cryptocurrency entities need to work together more in swapping information about cyber incidents.
Microsoft has attributed exploitation attempts of CVE-2023-27350 and CVE-2023-27351 to a Clop ransomware affiliate.
Top cybersecurity officials from the U.S., U.K., and other allies say international cooperation among intelligence and law enforcement agencies has been a key factor in successful operations against ransomware groups.