In an unprecedented coordinated effort, international law enforcement agencies have successfully dismantled several major botnets in what has been described as the largest ever operation against cybercrime.
Dubbed ‘Operation Endgame’, this large-scale crackdown involved multiple countries and led to significant disruptions in the operations of cybercriminals worldwide.
Details of the operation
Between May 27 and 29, 2024, Operation Endgame, coordinated from Europol’s headquarters, targeted numerous malware droppers, including IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee, and Trickbot.
These droppers are known for facilitating various forms of cybercrime, such as ransomware attacks, by installing additional malware onto infected systems.
This is the largest ever operation against botnets, which play a major role in the deployment of ransomware.
Europol statement (source)
The coordinated actions led to:
- 4 arrests (1 in Armenia and 3 in Ukraine)
- 16 location searches (1 in Armenia, 1 in the Netherlands, 3 in Portugal and 11 in Ukraine)
- Over 100 servers taken down or disrupted in Bulgaria, Canada, Germany, Lithuania, the Netherlands, Romania, Switzerland, the United Kingdom, the United States and Ukraine
- Over 2 000 domains under the control of law enforcement.
One of the key suspects has reportedly earned at least €69 million in cryptocurrency through these illegal activities.
The suspect’s transaction are being closely watched, and legal authorization to take these assets upon future acts has already been obtained.
A global effort
Operation Endgame was led by France, Germany, and the Netherlands, with support from Denmark, the United Kingdom, the United States, and several other countries.
Europol facilitated the exchange of intelligence and provided analytical, crypto-tracing, and forensic support. Over 20 law enforcement officers coordinated the operation from Europol’s command post, with hundreds of officers participating globally.
Private sector partners such as cybersecurity companies, anti-malware groups, and threat intelligence organizations also played crucial roles in the operation.
With Operation Endgame, our authorities have dealt the biggest and most significant blow against cybercrime to date.
The thousands of victims will be alerted so they can protect themselves from other ransomware attacks.
said German Interior Minister Nancy Faeser in a statement for Reuters.
Impact
This operation has had a significant impact on the dropper ecosystem, disrupting the infrastructure used by cybercriminals.
The dismantled botnets, comprising millions of infected systems, were instrumental in various cybercrime activities, including ransomware attacks that have caused financial losses amounting to hundreds of millions of euros.
The operation not only targeted the infrastructure but also focused on high-value targets, freezing illegal proceeds, and seizing assets.
Seizure banner on a shut-down domain (source)
Identified cybercriminals
The Federal Criminal Police Office of Germany has revealed the identities of eight cybercriminals linked to the disrupted malware operations. They were added to Europe’s Most Wanted list.
These individuals, mostly of Russian descent, played central roles in managing and distributing malware such as Smokeloader and Trickbot.
Despite their identities being known, their current whereabouts remain uncertain, though they are believed to reside in Russia, with one suspect living in the United Arab Emirates.
Future actions
Operation Endgame does not conclude with this initial success. Europol has announced that further actions will be taken, and new operations will be launched to target suspects still at large.
Law enforcement agencies are also focused on alerting the thousands of victims affected by these botnets to help them protect themselves from future attacks.
Final thoughts
Operation Endgame is a major advance in the fight against cybercrime, showcasing the power of international cooperation.
Europol and its partners have demonstrated strong dedication to disrupting these malicious networks. The success of Operation Endgame not only deals a significant blow to cybercriminals but also enhances digital safety for all.
We recognize the importance of these efforts in our mission to combat cyber threats. We are committed to providing top-notch security solutions and supporting global actions that protect our digital spaces from ongoing cyber threats.
We will continue to monitor and provide updates as more information emerges. Stay tuned for more details.
You can also follow Operation Endgame on their official website.
If you liked this piece, you can find more on the blog. Follow us on LinkedIn, Twitter, Facebook, and YouTube for more cybersecurity news and topics.
Madalina, a seasoned digital content creator at Heimdal®, blends her passion for cybersecurity with an 8-year background in PR & CSR consultancy. Skilled in making complex cyber topics accessible, she bridges the gap between cyber experts and the wider audience with finesse.
