Every now and then, international law enforcement announces a stunning takedown of a cyber crime group.
Typically realized in the form of website shutdowns, in which the National Crime Agency logo is emblazoned across the dark web site of would-be hackers, these are powerful PR moves to show that cyber crime doesn’t always pay – and the seriousness with which law enforcement approaches these crimes.
But the truth is, hackers continue to operate. And sometimes, the very groups that have been billed done and dusted simply reemerge under a new site, new servers, or with a fresh coat of paint. What can we learn from this cycle – and does the industry need to take a different approach?
In this episode, Rory is once again joined by Ross Kelly, ITPro’s news and analysis editor, to explore some of the most prominent cyber crime gang takedowns we’ve had recently and what it means for the sector.
Highlights
"What you mentioned around, you know, data being leaked, that's vital intelligence for law enforcement, for threat researchers, and that's the big takeaway from a lot of these takedowns, I guess. In the wake of that, you're seizing domains, you're seizing servers, you're getting really valuable information on how these organizations work."
"The Veeam report said payments rose to an average of $1.1 3 million. And that's a 104% increase compared to the first quarter of this year. You know, the median payment rose two fold to $400,000, so it's high stakes. At the same time, though, we are seeing a stronger approach by enterprises. We had coverage out today as well, mentioning the fact that organizations are just outright refusing to pay and a part of that is down to the fact that they're really implementing more robust backup and recovery."
"With the Cobalt Strike situation, this is a really great example of enterprises teaming up law enforcement also having a critical role to play. The numbers speak for themselves: 200 malicious domains, 600 servers taken down by Europol. And misuse of the tool decreased by 80%, I mean that's a significant decrease there and I think it's an excellent example of the real impact that coordinated takedowns can have."
Footnotes
- BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new group
- Cobalt Strike abusers have been dealt a hammer blow: An "aggressive" takedown campaign by Fortra and Microsoft shuttered over 200 malicious domains – and it’s cut the misuse of the tool by 80%
- Hundreds of Cobalt Strike servers have been taken offline in a major law enforcement sting
- Ransomware victims are refusing to play ball with hackers – just 17% of enterprises have paid up so far in 2025, marking an all-time low
- Average ransom payment doubles in a single quarter
- 75% of UK business leaders are willing to risk criminal penalties to pay ransoms
- Can the UK ban ransomware payments?
- LockBit could be done and dusted after NCA operation gained access to admin environments, source code, and affiliate info
- LockBit ransomware group falls victim to hackers itself
- The Zservers takedown is another big win for law enforcement
- ‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
Subscribe
- Subscribe to The IT Pro Podcast on Apple Podcasts
- Subscribe to The IT Pro Podcast on Spotify
- Subscribe to the IT Pro newsletter
- Join us on LinkedIn
-
Warning issued as new Pakistan-based malware group hits millions globallyNews Tempting people in with offers of pirated software, the network installs commodity infostealers, according to CloudSEK
-
LevelBlue and Akamai are teaming up to launch a managed web application and API protection serviceNews The new Managed WAAP offering aims to help organizations secure their rapidly expanding web app and API ecosystems
-
July rundown: Salt Typhoon and SharePoint scaresITPro Podcast US public sector organizations are under serious threat from the state-backed hacking group
-
Can the UK ban ransomware payments?ITPro Podcast Attempts to cut off ransomware group profits could instead harm businesses
-
We need to talk about operational technologyITPro Podcast Groups like Volt Typhoon are abusing poor hygiene in critical infrastructure to pre-position for attacks
-
RSAC Conference 2025: The front line of cyber innovationITPro Podcast Ransomware, quantum computing, and an unsurprising focus on AI were highlights of this year's event
-
April rundown: MITRE frights and Microsoft launches Recall (again)ITPro Podcast As CISA delivered an eleventh-hour reprieve for the CVE database, AWS reportedly began to pause some data center leases
-
The new era of cyber threatsITPro Podcast With AI-powered attacks and state-backed groups, security teams face face a new wave of sophisticated threats
-
Supply chain scares and Google’s AI codeITPro Podcast As the ransomware attack on Blue Yonder disrupts a wide range of firms, Google moves to lead by example on internal AI code
-
Halloween special: Cybersecurity horror storiesPodcast Join us for three terrifying tales sure to chill any IT professional to the core
