Europol conducts largest operation against bot systems in several EU countries including Romania

Europol has taken control of over 100 servers in nine European countries, including Romania, in the largest operation against bot systems used for malware cyberattacks.

Operation Endgame, as Europol titled the action, focused on disrupting criminal services by arresting High-Value Targets, taking down criminal infrastructures, and freezing illegal proceeds. It targeted droppers including IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, and Trickbot.

These malware droppers are a type of malicious software designed to install other malware onto a target system. They are used in the first stage of a malware attack, during which they allow criminals to bypass security measures and deploy additional harmful programs, such as viruses, ransomware, or spyware.

“This is the largest ever operation against botnets, which play a major role in the deployment of ransomware. The operation, initiated and led by France, Germany, and the Netherlands was also supported by Eurojust and involved Denmark, the United Kingdom, and the United States. In addition, Armenia, Bulgaria, Lithuania, Portugal, Romania, Switzerland, and Ukraine also supported the operation with different actions, such as arrests, interviewing suspects, searches, and seizures or takedowns of servers and domains,” Europol said.

The operation was also supported by a number of private partners at the national and international levels, including Romania’s cybersecurity provider Bitdefender.

The coordinated actions led to 4 arrests (1 in Armenia and 3 in Ukraine), 16 location searches (1 in Armenia, 1 in the Netherlands, 3 in Portugal, and 11 in Ukraine), and over 100 servers taken down or disrupted in Bulgaria, Canada, Germany, Lithuania, the Netherlands, Romania, Switzerland, the United Kingdom, the United States, and Ukraine.

Europol discovered through the investigations so far that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure sites to deploy ransomware.

(Photo source: Motortion | Dreamstime.com)