Operation Endgame Hits Malware Delivery Platforms Krebs on Security

pLaw enforcement agencies in the United States and Europe today announced Operation Endgame a coordinated action against some of the most popular cybercrime platforms for delivering ransomware and datastealing malware Dubbed the largest ever operation against botnets the international effort is being billed as the opening salvo in an ongoing campaign targeting advanced malware droppers or loaders like IcedID Smokeloader and TrickbotppA frame from one of three animated videos released today in connection with Operation EndgameppOperation Endgame targets the cybercrime ecosystem supporting droppersloaders slang terms used to describe tiny custommade programs designed to surreptitiously install malware onto a target system Droppers are typically used in the initial stages of a breach and they allow cybercriminals to bypass security measures and deploy additional harmful programs including viruses ransomware or spywareppDroppers like IcedID are most often deployed through email attachments hacked websites or bundled with legitimate software For example cybercriminals have long used paid ads on Google to trick people into installing malware disguised as popular free software such as Microsoft Teams Adobe Reader and Discord In those cases the dropper is the hidden component bundled with the legitimate software that quietly loads malware onto the users systemppDroppers remain such a critical humanintensive component of nearly all major cybercrime enterprises that the most popular have turned into fullfledged cybercrime services of their own By targeting the individuals who develop and maintain dropper services and their supporting infrastructure authorities are hoping to disrupt multiple cybercriminal operations simultaneouslyppAccording to a statement from the European police agency Europol between May 27 and May 29 2024 authorities arrested four suspects one in Armenia and three in Ukraine and disrupted or took down more than 100 Internet servers in Bulgaria Canada Germany Lithuania the Netherlands Romania Switzerland the United Kingdom United States and Ukraine Authorities say they also seized more than 2000 domain names that supported dropper infrastructure onlineppIn addition Europol released information on eight fugitives suspected of involvement in dropper services and who are wanted by Germany their names and photos were added to Europols Most Wanted list on 30 May 2024ppA wanted poster including the names and photos of eight suspects wanted by Germany and now on Europols Most Wanted listppIt has been discovered through the investigations so far that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure sites to deploy ransomware Europol wrote The suspects transactions are constantly being monitored and legal permission to seize these assets upon future actions has already been obtainedppThere have been numerous such coordinated malware takedown efforts in the past and yet often the substantial amount of coordination required between law enforcement agencies and cybersecurity firms involved is not sustained after the initial disruption andor arrestsppBut a new website erected to detail todays action operationendgamecom makes the case that this time is different and that more takedowns and arrests are coming Operation Endgame does not end today the site promises New actions will be announced on this websiteppA message on operationendgamecom promises more law enforcement and disruption actionsppPerhaps in recognition that many of todays top cybercriminals reside in countries that are effectively beyond the reach of international law enforcement actions like Operation Endgame seem increasingly focused on mind games ie trolling the hackersppWriting in this months issue of Wired Matt Burgess makes the case that Western law enforcement officials have turned to psychological measures as an added way to slow down Russian hackers and cut to the heart of the sweeping cybercrime ecosystemppThese nascent psyops include efforts to erode the limited trust the criminals have in each other driving subtle wedges between fragile hacker egos and sending offenders personalized messages showing theyre being watched Burgess wroteppWhen authorities in the US and UK announced in February 2024 that theyd infiltrated and seized the infrastructure used by the infamous LockBit ransomware gang they borrowed the existing design of LockBits victim shaming website to link instead to press releases about the takedown and included a countdown timer that was eventually replaced with the personal details of LockBits alleged leaderppThe feds used the existing design on LockBits victim shaming website to feature press releases and free decryption toolsppThe Operation Endgame website also includes a countdown timer which serves to tease the release of several animated videos that mimic the same sort of flashy short advertisements that established cybercriminals often produce to promote their services online At least two of the videos include a substantial amount of text written in RussianppThe coordinated takedown comes on the heels of another law enforcement action this week against what the director of the FBI called likely the worlds largest botnet ever On Wednesday US Department of Justice DOJ announced the arrest of YunHe Wang the alleged operator of the tenyearold online anonymity service 911 S5 The government also seized 911 S5s domains and online infrastructure which allegedly turned computers running various free VPN products into Internet traffic relays that facilitated billions of dollars in online fraud and cybercrimepp
This entry was posted on Thursday 30th of May 2024 1119 AM
ppDroppers can also be used in phishing scams as in loading banking trojansppLaw enforcement agencies in the United States and Europe are trying to smash the competitionppThat makes senseppI have the popcorn readyppPiles of Kettle Corn and Microwave Pork Rinds on order ppinj theyre coming for uppKrebs is being political All the way blame russians when actual criminals is obviously ukrainiansppTaras ooh you are being cute Of course Russians would never do such a thing their superior races high moral standards would keep them from even considering such a career as cybercrime let alone acting in a subversive manner on the states orders No no that must be othersppDid you just pull your head out of the sand Russians have been doing this for over 15 years but you seldom if ever hear of one being arrested and then only if he is stupid enough to leave RussiappTaras
Please write your own blog Please get your own followers Dont tell someone how to run their forum Funny you mention he is being political then you say when the actual criminals is obviously ukrainians Sorry I thought I was reading a 2nd graders paper
Stop being political TarasppTaras is actually a Ukrainian name Clearly Taras is being a trollppI even didnt see a political thing youre seriously I dont think hes not right BTW Im write this from Russia but I dont think what these hackers activities is right cuz RIGHT NOW WE DECLARING WAR ALL THE WORLD WE THREATEN NUCLEAR WEAPONS ITS NOT NORMALppFrom the photo it looks like all but one of them has had their nose broken at least once last one just before the photo or multiple times Almost funny but makes me think most of these criminals have no idea what a pleasant life can be like outside of crime and violence No wonder they dont care if they hurt others all they know is suffering abuse its normal to thempphi nice blog i read and enjoyedppOperation Endgames crackdown on malware delivery platforms is a crucial step in enhancing cybersecurity By dismantling the infrastructure behind cyber threats this initiative helps protect both individuals and organizations from significant harm Its a strong reminder of the importance of proactive measures in the fight against cybercrimepphttpssennovatecom5essentialcybersecuritytipstosecureyourbusinessin2024
check this blog outpphttpssennovatecomppYour email address will not be published Required fields are marked ppComment ppName ppEmail ppWebsite pp

ppppΔdocumentgetElementById akjs1 setAttribute value new Date getTime ppMailing ListppSearch KrebsOnSecurityppRecent PostsppStory CategoriesppWhy So Many Top Hackers Hail from Russiap