Dutch police dismantles several botnets in operation against ransomware

During Operation Endgame, an international coordinated operation aimed at disrupting criminal services, the Dutch police took down 33 servers, which played a major role in the deployment of ransomware.

Botnets like IcedID, Smokeloader, SystemBC, Pikabot and Bumblebee were taken down in order to destroy criminal infrastructures and freeze illegal revenues. In recent days, four arrests and sixteen location searches were conducted worldwide.

In addition, over a hundred servers were taken down or disrupted in Bulgaria, Canada, Germany, Lithuania, the Netherlands, Romania, Switzerland, the United Kingdom, the United States and Ukraine. The servers that the law enforcement agencies have confiscated weren't just used for ransomware attacks, but also to commit financial fraud and other criminal activities.

Furthermore, law enforcement took control over 2,000 domain names. Through investigation detectives learned that the main suspect had earned more than 69 million euros in cryptocurrency by renting out criminal infrastructure sites to deploy ransomware and other malware. The earnings will be seized as soon as possible.

Operation Endgame will continue

The criminal organizations responsible for the botnets have been spreading malware for years via hundreds of millions phishing emails. In the past year alone, several million computers worldwide have been infected with ransomware or other malicious software.

Operation Endgame, which took place between May 27 and 29, is the largest operation against botnets, which play a major role in the deployment of ransomware.

The operation was led by France, Germany and the Netherlands and supported by Denmark, The United Kingdom and the United States. Numerous private security companies joined forces with law enforcement agencies, like Computest, Northwave, Fox-IT and Proofpoint.

Europol facilitated the information exchange and provided analytical, crypto-tracing and forensic support to the investigation.

Operation Endgame doesn’t end here. New actions will be announced on the Operation Endgame website. Suspects who haven’t been detained, will get the chance to come forward and report themselves to the police.