Operation Endgame strikes the ransomware access brokers.
The ransomware threat suffered a serious, if not fatal, injury this week as multiple law enforcement actions took aim at the global criminal enterprise. Microsoft led the way in taking down large parts of the infrastructure behind the Lumma Stealer network behind the capture and sharing of compromised credentials. This comes after one leading ransomware group, LockBit, was itself hacked. Now Europol, with help from both the Federal Bureau of Investigation and the U.S. Secret Service, has hit at the very heart of the ransomware kill chain by targeting initial access operators. Here’s everything you need to know about the latest Operation Endgame success.
Breaking The Ransomware Kill Chain
“Cybercriminals around the world have suffered a major disruption,” Europol stated after confirming the latest stage of Operation Endgame, which has significantly impacted the ability of ransomware groups, or more accurately, their affiliates, to execute their malicious attacks. By dismantling the infrastructure used by seven of the leading initial access malware operators, Operation Endgame hopes to strike a blow against the tools that are used to launch most ransomware attacks.
Working alongside the FBI, Secret Service and the Department of Justice in the U.S., as well as other global law enforcement agencies, Europol said in a May 23 statement that it had taken down 300 servers, negated 650 domains and issued international arrest warrants against 20 cybercriminals.
Initial access malware is used to do what it says on the tin: gain initial access to systems and networks in order for ransomware affiliates to be able to then compromise the target and infect it with the ransomware malware itself. While there is a booming industry of initial access brokers, who sell ready-made packages to such affiliates, the availability of such software on a cybercrime-as-a-service basis has seen many bypass the broker and save a bit of money by doing it themselves. Operation Endgame targeted seven of these initial access malware operations, namely:
- Bumblebee
- Lactrodectus
- Qakbot
- Hijackloader
- DanaBot
- Trickbot
- Warmcookie
“By disabling these entry points,” Europol said, “investigators have struck at the very start of the cyberattack chain, damaging the entire cybercrime-as-a-service ecosystem.” All seven of the malware operations were successfully neutralised by the strikes.
Selena Larson, a staff threat researcher at Proofpoint, which was also involved in the actions, told me that “the disruption of DanaBot, as part of the ongoing Operation Endgame effort, is a fantastic win for defenders, and will have an impact on the cybercriminal threat landscape.” Not least, it will likely cause a rethink in tactics by imposing a cost on them in terms of legal jeopardy. “After last year’s Operation Endgame disruption,” Larson concluded, “the initial access malware associated with the disruption, as well as actors who used the malware, largely disappeared from the email threat landscape.” Let’s hope the same happens now and the ransomware threatscape shrinks as a result.