International action disables cybercriminal network
The police and the Public Prosecution Service have disabled various malware strains, dismantled botnets and conducted other investigations in an international action. Since 2018, millions of people around the world have fallen victims to the criminals behind these networks. This is another big blow in Operation Endgame.
During the international action week, Gootloader malware was shut down. In the Netherlands, 14 servers were taken down. In addition, 218 domain names were confiscated and 681 websites disinfected by the Netherlands Police and international partners. The actors behind Gootloader used search engines and they made suspicious websites appear on top in the search results. This was done via the infection of websites using Wordpress. When people clicked on these search results, they found themselves on criminals’ websites. The malware was spread through these websites. Infection eventually led to a ransomware attack, locking files and systems and barring access to their data for victims.
International cooperation
Both the Team High Tech Crime of the National Investigations and Special Operations Unit and the Team Cybercrime of the Unit of North Holland had a major role in the action, under the leadership of the National Public Prosecution Service. The investigation was carried out in close cooperation with Germany, Denmark, the United Kingdom, the United States and Canada with the support of Europol and Eurojust. Gootloader was elusive for a long time because of its complex, regularly updated way of work. Due to international cooperation, it was possible to take down the Gootloader infrastructure. Additional investigations targeting the main suspect of Gootloader malware has been carried out.
During the international action week, CastleRAT was also dismantled. In total 120 server were destroy with 6 of them in The Netherlands and 39 domains were confiscated. Also infrastructure of the infostealer StealC has been taken down. Since the last takedown in June, the police have been constantly monitoring new versions of StealC infostealers. In the meantime, 102 servers have been taken down, of which 80 have been taken down by the Netherland Police.
Sensitive data
RATs and infostealers are designed to steal sensitive data from victim’s computers. This personal and sensitive data is valuable for criminals. A RAT is designed to control computers remotely, for example by system administrators. They can use it to resolve technical problems remotely. Cyber criminals are exploiting this technique to gain access to the victims computers and networks. Subsequently, sensitive data such as login names, passwords, crypto wallets and system information is stolen from the victims computer and sent to the criminal. This personal data can be used by criminals to steal money or to access (corporate) networks and create new victims. Infostealers and RATs such as StealC and CastleRAT often from the first link in an attack chain.
Over 6.4 million stolen personal data items have been secured in this action. Data stolen by CastleRAT can be found at https://www.politie.nl/en/information/checkyourhack.html. More personal data will be added in the coming weeks. Victim data is also shared with Shadowserver, HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks and NL-NCSC.