Infostealer Malware Targeted by Police in Operation Secure

A months-long international police operation targeted infostealer infrastructure in a swath of Asian countries, resulting in the arrest of more than two dozen suspects, the seizure of tens of servers and tens of thousands of online domains.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Interpol announced Wednesday that Operation Secure, which it coordinated, counted participation from 26 countries in the Asia-Pacific region, from Brunei, Cambodia and Hong Kong, to India, Japan and Vietnam.

Participating countries collectively shut down 25,917 malicious IP addresses and domains and targeted the users of 69 infostealer variants from January through April. They ultimately arrested 32 suspects on cybercrime charges and seized 41 servers and over 100 gigabytes of data, including infostealer log data amassed through tools such as Lumma, Risepro and Meta Stealer.

Infostealers underpin a thriving market for stolen data. Log data is sold on cybercrime forums and markets, as well as automated Telegram channels or in other encrypted end-to-end app groups (see: Info-Stealing Malware Populates ‘Cloud of Logs’ Offerings).

Law enforcement ramped up pressure against infostealer operations with a May takedown of Lumma and an October operation against Redline and Meta. U.S. federal authorities indicted Russian national Maxim Rudometov for acting as a Redline developer and earlier this month pledged up to $10 million for information linking Rudometov or his associates to a foreign government.

Police disruptions do damage, but many infostealer operations rebound, sometimes within days – as is the case with Lumma (see: Lumma Stealer Malware Resurgence Challenges Global Takedown).

Vietnamese police arrested 18 suspects, seizing devices from homes and workplaces, and from the suspected ringleader seized 300 million Vietnamese dong, or $11,500, in cash, plus SIM cards and business documents pointing to an organized effort “to open and sell corporate accounts,” Interpol said.

Authorities in Sri Lanka arrested 12 suspects, while the Pacific island country of Nauru arrested two suspects. Hong Kong Police identified 117 command-and-control servers being hosted across 89 different internet service providers, also sometimes associated with phishing, fraud and social media scams.

Data collected by infostealers includes payment card data, passwords for online and corporate services – including VPNs – as well as for bank accounts and cryptocurrency wallets. Infostealers can steal information stored in browsers, cookies, including for two-factor authentication sessions, which attackers can use to emulate a legitimate user and defeat multifactor authentication defenses.

“These logs often enable initial access for ransomware deployments, data breaches, and cyber-enabled fraud schemes such as business email compromise,” Interpol said.

Interpol said police directly notified more than 216,000 victims or potential infostealer victims that their information had been recovered by police, “so they could take immediate action – such as changing passwords, freezing accounts or removing unauthorized access.”

Several private sector cybersecurity firms – Group-IB, Kaspersky and Trend Micro – contributed cyber activity reports, detailing critical intelligence for the operation, shared with government cyber teams across Asia. “These coordinated efforts resulted in the takedown of 79% of identified suspicious IP addresses,” Interpol said.