Hundreds of servers have been taken down as part of an international law enforcement operation against ransomware groups.
Coordinated by Europol and Eurojust, the action saw key infrastructure dismantled over the last week, with 300 servers taken down, 650 domains neutralized, and nearly two dozen international arrest warrants issued.
In a statement confirming the campaign, Europol revealed more than €3.5 million in cryptocurrency was seized.
This brings the total amount netted during Operation Endgame - an ongoing, international operation against ransomware services and infrastructure - up to more than €21.2 million.
The operation focused on initial access malware, and neutralized the Bumblebee, Lactrodectus, Qakbot, Hijackloader, DanaBot, Trickbot, and Warmcookie malware strains.
Arrest warrants were issued against 20 individuals believed to be providing or operating initial access services to ransomware operators.
This latest phase of Operation Endgame follows on from the largest-ever international action against botnets in May 2024. That targeted the new malware variants and successor groups that had re-emerged after previous takedowns.
"This new phase demonstrates law enforcement’s ability to adapt and strike again, even as cyber criminals retool and reorganize," said Europol executive director Catherine De Bolle.
"By disrupting the services criminals rely on to deploy ransomware, we are breaking the kill chain at its source."
Europol has now put out a public appeal to track down suspects who are believed to have provided or operated the ransomware tools.
DanaBot ransomware criminals snared
Meanwhile, also as part of Operation Endgame, the US Department of Justice has indicted a series of people associated with two of the ransomware groups.
Russian national Rustam Rafailevich Gallyamov, 48, is charged with leading the cyber crime group that developed and deployed the Qakbot malware.
From 2019 onward, it's alleged, Gallyamov used the Qakbot malware to infect thousands of computers around the world as part of a botnet.
Once in, he's said to have provided access to co-conspirators who infected the computers with ransomware, including Prolock, Dopplepaymer, Egregor, REvil, Conti, Name Locker, Black Basta, and Cactus.
In exchange, he allegedly received part of the ransoms received from victims.
Similarly, another 16 people have been indicted for developing and deploying the DanaBot malware, which infected more than 300,000 computers around the world for fraud and ransomware, and which caused at least $50 million in damage.
"The enforcement actions announced today, made possible by enduring law enforcement and industry partnerships across the globe, disrupted a significant cyber threat group, who were profiting from the theft of victim data and the targeting of sensitive networks," said special agent in charge Kenneth DeChellis of the Department of Defense Cyber Field Office.
"The DanaBot malware was a clear threat to the Department of Defense and our partners. DCIS will vigorously defend our infrastructure, personnel, and intellectual property."
MORE FROM ITPRO
- What is polymorphic malware?
- Why ‘malware as a service’ is becoming a serious problem
- Malware-free attacks: The threat to businesses
-
Microsoft quietly launched an AI agent that can detect and reverse engineer malwareNews Researchers say the tool is already achieving the “gold standard” in malware classification
-
AWS CEO Matt Garman just said what everyone is thinking about AI replacing software developersNews Junior developers aren’t going anywhere, according to AWS CEO Matt Garman
-
Microsoft quietly launched an AI agent that can detect and reverse engineer malware
News Researchers say the tool is already achieving the “gold standard” in malware classification
-
Malicious URLs overtake email attachments as the biggest malware threatNews With malware threats surging, research from Proofpoint highlights the increasing use of off-the-shelf 'phish kits' like CoGUI and Darcula
-
Warning issued as new Pakistan-based malware group hits millions globallyNews Tempting people in with offers of pirated software, the network installs commodity infostealers, according to CloudSEK
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
-
Google cyber researchers were tracking the ShinyHunters group’s Salesforce attacks – then realized they’d also fallen victimNews In an update to an investigation on the ShinyHunters group, Google revealed it had also been affected
-
Nearly one-third of ransomware victims are hit multiple times, even after paying hackersNews Many ransomware victims are being hit more than once, largely thanks to fragmented security tactics
-
75% of UK business leaders are willing to risk criminal penalties to pay ransomsNews A ransom payment ban is a great idea - until you're the one being targeted...
