Following the massive botnet takedown codenamed Operation Endgame in May 2024, which shut down the biggest malware droppers, including IcedID, SystemBC, Pikabot, Smokeloader and Bumblebee, law enforcement agencies across North America and Europe dealt another blow to the malware ecosystem in early 2025.
In a coordinated series of actions, customers of the Smokeloader pay-per-install botnet, operated by the actor known as ‘Superstar’, faced consequences such as arrests, house searches, arrest warrants or ‘knock and talks’. Superstar used his botnet to run a pay-per-install service, enabling customers to gain access to victims’ machines. Customers used the service to deploy malware for their own criminal activities. Investigations revealed that botnet access was purchased for a range of purposes, including keylogging, webcam access, ransomware deployment, cryptomining and more.
Read more…
Source: Europol
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- UK: Police Federation Confirms Ransomware Breach
March 22, 2019
The Police Federation of England and Wales (PFEW) has confirmed that it has suffered a ransomware attack, but has said that it was not specifically targetted and was likely to have been impacted as part of a wider campaign. The ransomware attack has apparently only impacted computers at its headquarters in Surrey, and the PFEW said ...
- German States Approve Criminal Law Targeting Dark Web Infrastructure
March 18, 2019
Germany’s federal states have voted in favour of a measure to extend criminal sanctions against those providing infrastructure to so-called “dark web” sites used for illegal purposes, such as selling firearms, drugs or illegal content. The measure, which critics have called overly broad, is the latest sign of a crackdown in Europe and elsewhere on the internet’s perceived ...
- Russian national, author of NeverQuest banking trojan, pleads guilty
February 23, 2019
A Russian national pleaded guilty today in a New York court of creating, running, and infecting users with the NeverQuest banking trojan –also known as Snifula and Vawtrack. The man’s name is Stanislav Vitaliyevich Lisov, a Russian national who went online under the names of “Black” and “Blackf,” and who, according to a Department of Justice press ...
- Ex-US Air Force intelligence officer charged with spying for Iran
February 14, 2019
U.S. authorities on Wednesday charged former Air Force intelligence officer Monica Witt with helping Iran launch a cyber-spying operation that targeted her former colleagues after she defected from the United States. The U.S. Justice Department said Witt, 39, assembled dossiers on eight U.S. military intelligence agents she had worked with for Iranian hackers, who then used Facebook and ...
- FBI arrests second Apophis Squad hacker in the US
February 13, 2019
The FBI arrested yesterday a hacker part of a hacking team known as Apophis Squad. This is the second arrest of an Apophis Squad member after UK cops arrested a teenager in August 2018. The two, US and UK citizens, respectively, have been charged in an indictment unsealed by the US Department of Justice yesterday. They stand ...
- Counter-Terrorism and Border Security Bill given Royal Assent
February 12, 2019
New laws which gives the give the UK greater powers to crackdown on hostile state activity, have today received Royal Assent. The Counter-Terrorism and Border Security Act 2019 also ensures sentencing for certain terrorism offences can properly reflect the severity of the crimes, as well as preventing re-offending and disrupting terrorist activity more rapidly. In addition, the act updates ...