Operation Endgame 2.0: Crackdown on Malware Networks

In a significant international effort to combat cybercrime, law enforcement agencies from Germany, including the Federal Criminal Police Office (BKA) and Europol, have launched 'Operation Endgame 2.0'. This operation has resulted in the issuance of over 20 arrest warrants and the dismantling of hundreds of malware-related servers.

As part of the operation, authorities in Germany successfully took offline 50 servers and seized control of 650 domains previously managed by cybercriminals. The investigation has led to the identification of 37 suspects, with the BKA and the Frankfurt General Public Prosecutor's Office actively pursuing these individuals. Notably, the operation targets members of the notorious malware groups Trickbot and Qakbot, with the suspects primarily being Russian nationals, making extradition efforts challenging.

The operation has also resulted in the confiscation of approximately EUR3.5 million worth of Bitcoin, further impacting the financial capabilities of these cybercriminals. In addition to server takedowns, investigators have focused on the technical infrastructure utilized by these malware authors, with a total of 300 servers being rendered inaccessible to the perpetrators.

On May 22, authorities from Microsoft and Europol announced the successful disruption of the command-and-control infrastructure associated with the Lumma infostealer malware, indicating a coordinated effort to target various malware variants.

The investigation encompasses several malware groups, including Bumblebee, Latrodectus, DanaBot, HijackLoader, Warmcookie, and Trickbot, which are known for deploying additional malicious software, such as ransomware. By disrupting these initial malware loaders, authorities aim to prevent subsequent ransomware attacks and other cyber threats.

The BKA's President expressed confidence in the effectiveness of their strategies, emphasizing the successful collaboration among international law enforcement in combating cybercrime. The Frankfurt General Public Prosecutor's Office highlighted the ongoing development of cooperative efforts to enhance responses to cyber threats.

In parallel, the U.S. Justice Department has taken action against Rustam G., the alleged main author of Qakbot, filing charges related to multiple attacks on businesses in the United States and Canada. Together with his associates, he is accused of infecting computers and deploying various ransomware attacks. Additionally, 16 individuals linked to the development and deployment of DanaBot malware are facing prosecution in California, with allegations of causing over $50 million in damages across more than 300,000 computers.

This second phase of Operation Endgame follows the initial operation launched nearly a year ago, which resulted in ten international warrants and the temporary detention of four suspects.