U.S. authorities on Thursday charged 16 defendants in a massive global operation to disrupt the Russia-based cybercrime group behind the DanaBot malware.
DanaBot infected more than 300,000 computers around the world, facilitating fraud and ransomware and resulting in more than $50 million in damage, according to federal prosecutors. The U.S. coordinated with multiple foreign governments and private cybersecurity firms to dismantle the botnet operators’ infrastructure.
The Department of Justice charged Aleksandr Stepanov, 39, a.k.a. “JimmBee,” with conspiracy, conspiracy to commit wire and bank fraud and additional charges. Artem Aleksandrovich Kalinkin, 34, a.k.a. “Onix,” was charged with conspiracy to gain unauthorized access to a computer to gain information and to defraud, among additional charges.
DanaBot, which operates as a malware-as-a-service, was first identified in 2018, according to Proofpoint, which first discovered the malware. DanaBot became a favorite payload of a threat group identified as TA547 but was later adopted by several other threat actors, including TA571 and TA564.
DanaBot nearly disappeared from view in mid-2020 before returning to prominence in December 2023.
DanaBot recently surfaced in a cyberattack campaign against transportation and logistics firms. In another recent operation, hackers used DanaBot while impersonating travel booking firms and leveraging a technique called ClickFix.
DanaBot used spam email messages that contained malicious attachments or hyperlinks, according to court documents. Infected computers became part of a botnet and the operators could then remotely control those computers without the user knowing.
The hackers used a second version of the botnet to spy on military, diplomatic and government targets in North America and Europe.
The DanaBot disruption was part of a larger effort called Operation Endgame. Germany, the Netherlands and Australia worked with the U.S. on the investigation, with support from cyber researchers and others at Amazon, CrowdStrike, ESET, Google and other firms.
“Cybercriminal disruptions and law enforcement actions not only impair malware functionality and use, but also impose cost to threat actors by forcing them to change their tactics, cause mistrust in the criminal ecosystem and potentially make criminals think about finding a different career,” Selena Larson, staff threat researcher at Proofpoint, which also provided key support, said in a statement.