Ransomware is used by hackers to lock users out of computer systems until a ransom is paid. Image source: drobotdean, via Freepik.
Ransomware networks allegedly responsible for extorting hundreds of millions of dollars have been targeted by multiple countries in a largescale operation.
The operation– given the codename “Endgame”– was coordinated by Eurojust, the European Union’s judicial cooperation agency.
Eurojust coordinated police agencies across America and Europe to take control of over 2000 internet domains and 100 servers worldwide in a series of raids.
The countries involved included France, Germany, Denmark, the Netherlands, Ukraine, the United Kingdom, and the United States.
Raids were carried out in Ukraine, Portugal, the Netherlands, and Armenia, leading to the arrest of four “high value” suspects. Three were arrested in Ukraine and the fourth in Armenia.
This was the latest international operation to target ransomware operations and disrupt malware. Eurojust and police agencies have used the success to warn cybercriminals that “no one is untraceable”.
Ransomware is a form of malware based around software designed to block access to a computer system until a requisite sum of money is paid.
It is often sent to potential targets through phishing emails. These emails will contain a link to an infected website, which will automatically download and install the malware without the users’ knowledge.
Once the malware is installed, hackers can steal data or lock the infected device.
The financial damage caused by hackers to individual users, companies, and governments can be immense, upwards of hundreds of millions of dollars.
Eurojust’s operation targeted specific malware “droppers”, malicious software spread in phishing emails or attachments such as shipping invoices and order forms.
The targeted droppers for operation Endgame were the following malware– IcedID, Pikabot, Smokeloader, Bumblebee and Trickbot.
German authorities are seeking the arrest of seven further individuals on suspicion of membership of an organisation that had the goal of spreading Trickbot malware.
An eighth person is suspected of being a ringleader behind malicious bot application Smokeloader.
EU police agency Europol has stated that this will not be the last cybercrime takedown and that further action will be announced soon.
