It has been reported that law enforcement agencies across Europe and North America have made additional arrests to dismantle the illicit ecosystem supporting malware distribution and deployment as part of a wider global effort. As part of Operation Endgame, which was launched in May 2024, we aim to disrupt the cyberattack supply chain by focusing on both the developers and the technical infrastructure behind several high-profile malware strains, which is known as Operation Endgame.
IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, and Trickbot were just a few of the malware families identified in this investigation—all of which have played an important role in enabling a wide variety of cybercriminal activities over the years. The latest development in this matter has been the arrest of multiple people identified as customers of the Smokeloader botnet, a malware-as-a-service platform which operates based on a pay-per-install-based marketing strategy.
An administrator of the botnet, a cybercriminal operating under the alias "Superstar", is believed to have found these individuals by looking at a customer database maintained by the botnet's administrator. As Europol explained, the arrested parties used Smokeloader to gain unauthorized access to victims' systems and engaged in a series of malicious activities, including logging keystrokes, monitoring webcams, deploying ransomware, crypto mining, and other forms of cyber exploitation, all in violation of the law.
As a result of this operation, it is clear that not only is malware infrastructure being dismantled, but also end users who are perpetuating cybercrime by purchasing and using illicit services are becoming increasingly important.
As a result of the arrests, international cybersecurity enforcement has become stronger and the global law enforcement community is cooperating more to combat sophisticated digital threats, marking a significant step forward in securing cyber security.
Law enforcement agencies have turned their attention to individuals who have used the Smokeloader botnet to facilitate a variety of cybercrime activities as part of a strategic escalation of Operation Endgame.
Smokeloader is a malicious software application that works on a pay-per-install basis and was operated by an individual known as Superstar who also used the alias “Superstar” to control the malware.
As a result of this botnet, clients were able to remotely infect victims' systems, providing a pathway for the deployment of additional malware and gaining long-term access to compromised systems which were not previously accessed by legitimate users.
In contrast to traditional malware takedowns, which are mainly focused on developers, and command-and-control infrastructure, this phase targeted end users—individuals and entities who provided financial support and benefits for the deployment of the malware.
It was found that these individuals were able be tracked down through a database maintained by the operator of the botnet, which contained detailed information about the users, including their names and contact information.
According to the arrests, the individuals were able to purchase Smokeloader access so that they could conduct a wide variety of malicious campaigns, ranging from keylogging to steal credentials to the activation of webcams to spy on their victims to deploying ransomware to extort money, mining cryptocurrencies on the victims' computers, and many other types of data theft and system abuse.
The authorities are sending a clear message to clients of these malware services by pursuing their clientele, which means that they are going to take legal action against anyone engaging in cybercrime activities, whether they are participating in the development, distribution, or consumption of it. This approach marks a significant evolution in cybercrime enforcement that has emphasized the dismantlement of the technical infrastructures as well as the elimination of the demand side of the malware ecosystem that has allowed these services to flourish for so long.
It has been reported that the coordinated arrests are an important step toward addressing the wider landscape of cyber threats, and that international collaboration in combating digital crime at various levels is increasing. Recently, multiple sophisticated phishing and malware distribution campaigns have been exposed by cybersecurity firms, indicating a new trend that has emerged in the fight against cyber crime.
According to Symantec Inc., a division of BroadcomInc.c, there is currently a campaign in the wild that exploits Windows.SCR (screensaver file format) for the distribution of a malware loader developed in Delphi referred to as ModiLoader, previously known as DBatLoader and NatsoLoader, among others
The loader is meant to infect systems in a silent manner and facilitate the execution of additional malicious payloads. Furthermore, security researchers have observed another deceptive campaign that utilizes malicious Microsoft Installer files to install Legion Loader, a stealthy malware strain designed to escape detection while delivering secondary threats.
Using a technique called pastejacking or clipboard hijacking, Palo Alto Networks’ Unit 42 says the attackers are tricking users into pasting pre-copied, malicious commands into the Windows Rudialogueog box, which is known as “pastejacking” or “clipboard hijacking.” Additionally, multiple evasion methods have been employed to obfuscate the attack chain, such as CAPTCHA verification steps, and fake blog websites that are masquerading as legitimate sources of malware distribution and hosting.
In addition to this, it has continued to play a vital role in the distribution of a loader named Koi Loader which functions as a precursor to a wider infection process by ultimately distributing the loader itself.
As soon as the Koi Loader is executed, it retrieves and activates the secondary malware known as the Koi Stealer. This Trojan is capable of stealing sensitive data and leaking sensitive information. As noted in a recent study by eSentire, Koi Loader and Koi Stealer both employ anti-virtualization and anti-sandboxing techniques, which allows them to bypass automated threat analysis systems, resulting in their ability to bypass them.
The GoodLoader malware-also known as SLOWPOUR—has resurfaced in recent months, causing concern.
Search engine poisoning has become a common tactic of this threat actor in November 2024. It is documented that malicious sponsored ads are placed on Google as a search engine poisoning tactic. The target users include individuals searching for common legal documents, such as "non-disclosure agreements".
To lure victims to fraudulent websites, such as Lawliner [maintain privacy], victims are prompted to submit personal information, including their e-mail addresses, under the pretence of downloading a legitimate document.
The Smokeloader botnet has been widely used by cybercriminals to conduct a wide variety of malicious activities. These activities included the spread of ransomware, unauthorized crypto mining, remote webcam surveillance, keystroke logging, and keystroke harvesting in order to gather sensitive user information.
The ongoing Operation Endgame has brought law enforcement agencies an important breakthrough by seizing a database containing detailed information about Smokeloader subscribers who had subscribed to Smokeloader's services as part of a critical breakthrough. As a result of this data, investigators have been able to identify individuals by using their digital identities - like usernames and aliases - to unmask those who are involved in cybercriminality.
In some instances, the identified suspects have cooperated with authorities by allowing them access to their devices and allowing digital evidence to be forensically analyzed.
Due to these voluntary disclosures, additional connections within the cybercrime network have been discovered, along with additional participants involved in the spread of malware and the use of cybercriminals.
To increase public awareness and transparency concerning the investigation, Europol has launched a dedicated Operation Endgame portal, where regular updates are released regarding the investigation. In addition, the agency has also created a series of animated videos which illustrate the various phases of the investigation.
As part of the operation, a combination of cyber forensics, international cooperation, and intelligence gathering is used to identify and track suspects.
This website, which can be accessed in multiple languages, including Russian, encourages individuals with information that relates to this function to report it directly to the support centre, allowing artificialities to be corrected instantly. In addition to these enforcement actions, this operation has had broader geopolitical effects.
There has been a significant dismantling of a number of prominent malware loader networks in the past year, and the European Union has imposed sanctions on six individuals accused of orchestrating or facilitating cyberattacks on critical sectors. These sectors include national infrastructures, classified information systems, and emergency response teams across member states.
The US Department of Treasury has taken parallel measures, sanctioning two cryptocurrency exchanges, Cryptotex and PM2BTC, for allegedly serving as a money laundering platform for ransomware operators and other cybercriminal entities, particularly those located in the Russian Federation, which led to the enforcement of parallel measures.
International authorities are taking coordinated action to disrupt the financial and logistical foundations of cybercrime, and these coordinated policies demonstrate a growing commitment by international authorities to doing so.
Despite the increasing threat of organized cybercrime, Operation Endgame is taking decisive global action to address it.
In combining legal enforcement and international cooperation with strategically optimizing disruptions, authorities are reinforcing their message that cybercriminals will not be allowed to play an unchecked role within the cybercriminal ecosystem. Investigative methods, tools, and techniques continue to be used by law enforcement agencies, so that they remain focused on remaining vigilant, increasing arrests, dismantling illicit digital technology, and keeping offenders accountable, regardless of their position in the supply chain.
