Europol and US Seize Website Domains, Luxury Goods in $6bn Cybercrime Bust

In a landmark operation, US authorities and Europol have dismantled what is being called the world’s largest botnet, responsible for an astonishing $6 billion in COVID-19 insurance fraud. This coordinated crackdown, involving multiple countries and agencies, marks a significant victory against cybercrime networks.

On Thursday, the US Department of Justice announced the arrest of YunHe Wang, a 35-year-old Chinese national, and the seizure of luxury items including high-end watches, over 20 properties, and a Ferrari. Wang is alleged to have amassed a fortune of $99 million by licensing malware to other criminals. His network, known as “911 S5”, operated from 2014 to 2022, spreading ransomware through infected emails and defrauding COVID-19 relief programs.

US Assistant Secretary for Export Enforcement, Matthew Axelrod, noted the extraordinary nature of the case, likening it to a screenplay. If convicted, Wang faces up to 65 years in prison for charges including conspiracy to commit computer fraud, wire fraud, and money laundering.

The European Union’s judicial cooperation agency, Eurojust, and Europol coordinated a massive international effort named “Operation Endgame”. This operation spanned across Germany, the Netherlands, France, Denmark, Ukraine, the United States, and the United Kingdom. Authorities arrested four high-value suspects, dismantled over 100 servers, and seized more than 2,000 internet domains. Additional arrests were made in Ukraine and Armenia, with further searches conducted in Ukraine, Portugal, the Netherlands, and Armenia.

This operation is part of a broader international effort to combat malware and ransomware. Eurojust highlighted the scale of this operation as one of the largest against cybercrime, drawing comparisons to the 2021 takedown of the Emotet botnet.

The financial damage inflicted by this cybercrime network is estimated in the hundreds of millions of euros. Dutch authorities emphasized the widespread impact, noting that millions of individuals fell victim as their systems were hijacked and turned into botnets.

One of the main suspects reportedly earned at least €69 million ($74 million) in cryptocurrency by renting out criminal infrastructure used for spreading ransomware. Europol has been closely monitoring these transactions and has obtained legal permission to seize assets in future actions.

The operation targeted several sophisticated malware “droppers” including IcedID, Pikabot, Smokeloader, Bumblebee, and Trickbot. These droppers are malicious software typically spread through emails with infected links or attachments such as invoices or order forms. By dismantling the infrastructure behind these droppers, the operation had a significant global impact on the malware ecosystem, hindering ransomware and other malicious software attacks.

Dutch police issued a stern warning to cybercriminals, emphasizing that online anonymity does not equate to immunity from law enforcement. Stan Duijf of the Dutch national police stated that the operation demonstrates that everyone leaves tracks online, reinforcing the message that cybercriminals are not beyond the reach of justice.

Europol has pledged that Operation Endgame is not the end, promising further actions and updates through their dedicated website. This ongoing commitment highlights the continuous battle against cybercrime and the importance of international cooperation in these efforts.