European Police Take Down Botnet Servers, Make Arrests

An international law enforcement operation resulted in the arrests of four botnet operators and the seizure of more than 100 servers used as infrastructure for malware dropper botnets.

See Also: Live Webinar | Digital Doppelgängers: The Dual Faces of Deepfake Technology

The European, British and U.S. police action, dubbed Operation Endgame, took down infrastructure sustaining botnets including IcedID – also known as BokBot and SystemBC, Pikabot, SmokeLoader, Bumblebee and TrickBot. An infection by those botnets is typically a precursor to ransomware or other malware. One-third of the seized servers were in the Netherlands, Dutch police said.

As part of the operation, Armenian police arrested one person and Ukrainian police arrested three. Police suspect that some of the detained individuals previously operated the Emotet botnet, the subject of a 2021 multinational law enforcement operation that – typical of botnet takedowns – severely disrupted but did not entirely destroy the criminal operation (see: Emotet Returns With New Tricks Up Its Sleeve).

Europol said one of the detained suspects earned cryptocurrency worth at least 69 millions euros through botnet operations. “The suspect’s transactions are constantly being monitored and legal permission to seize these assets upon future actions has already been obtained,” said the Netherlands-based European Union law enforcement coordination agency.

Police also confiscated around 2,000 domains associated with the botnets. Attackers often combine malware-as-a-service offerings to execute ransomware attacks (see: Emotet, Ryuk, TrickBot: ‘Loader-Ransomware-Banker Trifecta’).

German police are actively searching for eight suspects. They include Russian national Airat Gruber, the suspected admin of SmokeLoader, and Oleg Kucherov, Sergey Polyak, Fedor Andreev, Georgy Tesman, and Anton Bragin, who are wanted for their roles in operating and extorting ransomware.

The announcement of the operation comes just a day after U.S. authorities announced a multinational operation against the 911 S5 botnet and the arrest of three Chinese nationals who either were involved in its administration or helped launder it proceeds (see: FBI Says It Dismantled ‘Likely the World’s Largest Botnet’).

Security researcher Troy Hunt, founder of Have I Been Pwned analyzed email addresses and unique passwords provided by law enforcement agencies obtained through Operation Endgame and concluded that around 4.5 million of them associated with the latest action had not been previously linked to any data breaches.