Vancouver/Netherlands/Germany/Greece – This week, investigators with the RCMP Federal Policing – Pacific Region, Cybercrime Investigative Team – Vancouver (CIT-V) in partnership with international law enforcement agencies succeeded in dismantling an infostealer, a Remote Access Trojan (RAT), and a botnet, all of which played a role in international cybercrime.
This is the third large-scale action in Operation ENDGAME (English only) which was initiated in 2022 and is the largest operation ever conducted to combat criminal infrastructure used for ransomware attacks worldwide and target cybercriminals who utilize malicious software to victimize people, including Canadian victims. The RCMP is a partner in this operation.
Operation ENDGAME is a collaboration between the authorities of the Netherlands, Germany, the United States, Australia, France, Denmark, Belgium, the United Kingdom and Canada, with the support of Europol and Eurojust.
The Operation enabled authorities to simultaneously take down the infostealer, RAT and botnet and disrupt the infrastructure used by cybercriminals. These malware can be used for different types of cybercrime, for example ransomware. One of the biggest infostealers (Rhadamanthys), a RAT (VenomRAT) and botnet (Elysium) are dismantled and taken down. The main suspect for VenomRAT was arrested in Greece on the 3rd of November.
Infostealers and botnets are among the software most commonly used worldwide to steal sensitive personal data (e.g., passwords and banking details) from devices. Criminal services have a business model in which a cybercriminal can buy a botnet – a network of infected computers – so they can take control over these computers and transfer the data onto their own server. A RAT is software with which a cybercriminal can log into a single base computer and then control all registered computers remotely. Cybercriminals use this software to gain full control over a digital system.
In total 1025 servers were dismantled, 20 domain names were seized, there was 1 arrest and 11 searches worldwide (9 searches in the Netherlands, 1 in Germany and 1 in Greece).
“Cybercrime knows no borders, and neither does our response. Operation Endgame demonstrates that when law enforcement agencies unite across jurisdictions, we can dismantle even the most sophisticated criminal networks,” said Superintendent Adam MacIntosh, Officer in Charge of the Cyber and Financial Investigation Teams in the Pacific Region. “Through direct participation alongside our international partners, we’re sending a clear message: there is no safe haven for those who exploit the digital landscape to harm our communities, businesses and infrastructure.”
CIT-V thanks RCMP Federal Policing Cybercrime and the National Cybercrime Coordination Centre (NC3) for their support in the ongoing effort to combat cybercrime.
