Global Cybercrime Takedown: Authorities Disrupt Malware and Infostealer Operations

In a significant blow to cybercrime, international authorities and private technology companies have joined forces to disrupt a notorious cybercrime operation that had amassed millions of login credentials and stolen over $47 million through ransom payments and other fraudulent means. The operation's success hinged on the simultaneous disruption of two widely used tools: Amadey, a malware-as-a-service platform, and StealC, an infostealer-as-a-service platform. Amadey, which has been active since at least 2018, was observed exploiting GitHub to collect system information and install customized payloads. StealC, on the other hand, collected credentials, authentication cookies, and other sensitive information.

By severing the common infrastructure that supported both tools, authorities have effectively broken a critical link in the cybercrime chain. According to Microsoft, which analyzed the tools using AI, many cybercrime operators relied on both Amadey and StealC in their activities. The company's attorneys used this insight to obtain an order disrupting both operations simultaneously. This coordinated effort has dealt a significant blow to the cybercrime 'assembly line,' where these tools were used to drive ransomware, financial fraud, and disruptions to public services.

By targeting the underlying infrastructure that supported these tools, authorities have sent a strong message to cybercrime operators that their activities will not go unchecked.

Source: Ars Technica