Initial Access Brokers Targeted in Operation Endgame 2.0

Law enforcement in a European-led operation against malware often used as a precursor to ransomware took down 300 servers worldwide, police said Friday.

See Also: Why Cyberattackers Love ‘Living Off the Land’

In a coordinated operation that ran between May 19 to May 22, European, British and U.S. cyber defenders also neutralised 650 domains linked to malware strains including Bumblebee, Lactrodectus, Qakbot, Hijackloader, DanaBot, Trickbot and Warmcookie. “A direct blow to the ransomware kill chain,” Europol said.

“Operation Endgame” additionally resulted in international arrest warrants against 20 suspected Russian national malware developers, many already wanted in the United States. Law enforcement had cooperated this time last year under the same Operation Endgame rubric to take down botnets in a sweep Eurpopol called the “largest-ever international action against botnets” (see: European Police Take Down Botnet Servers, Make Arrests).

This year’s successor operation “targeted new malware variants and successor groups that re-emerged after last year’s takedowns, reinforcing law enforcement’s capacity to adapt and strike back – even as cybercriminals retool and reorganise,” Europol said.

The operation came during a week filled with takedowns and indictments. U.S. authorities said Thursday they seized command and control servers used by operators of the DanaBot malware while unsealing indictments against 16 members of the Russia-based cybercrime gang that deployed it (see: US Takes Down DanaBot Malware, Indicts Developers).

U.S. law enforcement and Microsoft on Wednesday announced seizure of the central command structure and thousands of online domains used to control the Lumma Stealer. Federal prosecutors unsealed an indictment against Russian national Rustam Rafailevich Gallyamov, 48, for Qakbot malware operation since its inception in 2008 as a banking Trojan (see: Breach Roundup: US Indicts Qakbot Malware Leader).

Malware targeted by authorities this week often results in a ransomware attack, with hackers behind the initial malware infection selling access to compromised machines to ransomware groups or collaborating directly with ransomware operators.

Domains targeted in the latest action include 50 servers in Germany. The Public Prosecutor’s Office in Frankfurt listed 18 individuals affiliated linked to Trickbot and Qakbot to the EU Most Wanted list.