Investigators achieved “biggest blow against global cybercrime”

This was announced by the Frankfurt am Main Public Prosecutor’s Office and the German Federal Criminal Police Office (BKA) on Thursday. Austrian authorities were also involved in the operation.

Domestic domains also affected

Domestic domains were also affected, as the spokesman for the Federal Criminal Police Office, Heinz Holub-Friedreich, said when asked. The experts carried out investigations into the area in order to check the information from Germany and provide administrative assistance. According to the German BKA, an asset seizure of 69 million euros was obtained against a server operator, and cryptocurrency worth more than 70 million euros was blocked.

The operation was primarily directed against the groups behind the six malware families “IcedID”, “SystemBC”, “Bumblebee”, “Smokeloader”, “Pikabot” and “Trickbot”. The dropper “Trickbot”, for example, was used in the USA, among other places, for attacks on hospitals and health centers during the corona pandemic. According to Europol, the total number of victims targeted by the now-dismantled groups can only be determined after the confiscated servers have been evaluated.

Data theft and ransomware

As the German BKA further announced, the six malware families in the focus of the international operation served as “door openers” for cyber criminals to infect attacked computer systems with further malware. The aim of such attacks was, among other things, to steal personal data such as user names and passwords – or to encrypt the attacked systems or networks with so-called ransomware. In ransomware attacks, hackers encrypt the data of affected companies, private individuals or authorities and then demand a ransom to release the data.

According to the information, ten international arrest warrants were issued and four people were provisionally arrested in the measures coordinated by German authorities. Germany issued arrest warrants against eight actors. On this basis, seven people are being sought who are strongly suspected of “having participated as members of a criminal organization for the purpose of distributing the Trickbot malware,” the investigators further announced.

Arrests in Armenia and Ukraine

A total of four suspects were arrested in Armenia and Ukraine. According to Europol, eight more suspects are to be placed on the EU-wide list of most wanted criminals. The “Endgame” operation was coordinated from Europol’s headquarters in The Hague.

During the operation on Tuesday and Wednesday, searches were carried out in a total of 16 properties in Armenia, the Netherlands, Portugal and Ukraine, during which numerous pieces of evidence were seized. The data seized are currently being evaluated and could lead to further investigations.

International participation

Law enforcement officials from the Netherlands, France, Denmark, Great Britain, Austria and the USA were involved in the operation. They were supported by the police authority Europol and the European Union Agency for Criminal Justice Cooperation.

The operation was carried out deliberately before the Olympic Games in Paris, the head of the French cybercrime unit, Nicolas Guidoux, told AFP. It was important to weaken the cybercriminals’ infrastructure before this “world event”.