4 ms·

4 people and 100 servers? that's all? that's a drop in a bucket, won't event make a dent in the black market of ransomware.

Cody-99 2y ago
>In addition, Europol released information on eight fugitives suspected of involvement in dropper services and who are wanted by Germany 4 people in the initial arrests. They already have arrest warrants for at least another 8. It seems they have arrested someone who provided a lot of infrastructure so it wouldn't surprise me if they were able to roll that into more arrests in the near future. >“It has been discovered through the investigations so far that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure sites to deploy ransomware,”
ASalazarMX 2y ago
Forget numbers, think Marvel's Endgame, envision cop superheroes from all over the world converging on the supervillain to enact justice and save civilization! I swear law enforcement and the military choose the cringest name codes, not much better than names kids would pick.
- b112 2y ago
  Government types do everything by committee and meeting, all responsibility for decisions is shared, everyone must agree. Thus nothing risky, edgy or creative makes it out of such meetings.
  - red-iron-pine 2y ago
    lol what? have you seen what comes out of the corporate world lately?
- nozzlegear 2y ago
  > I swear law enforcement and the military choose the cringest name codes, not much better than names kids would pick. I have it on good authority that the people in law enforcement and the military — and indeed all humans in general — were in fact kids at one point. Maybe we all just like cool sounding codenames, even if some keyboard jockeys on a forum will call it “cringe”.
  - ASalazarMX 2y ago
    I was a cringy kid too, but now I'm an adult that wouldn't call an official war strike "Operation Beastmaster" (real name from the Iraq invasion). Christ, how many years before we see names like "Operation CyBoRgDiNoSaUr"?
    - nozzlegear 2y ago
      > but now I'm an adult that wouldn't call an official war strike "Operation Beastmaster" (real name from the Iraq invasion). Why? That name’s dope. If you can’t give cool names to military operations of all things, then you can’t give cool names to anything. And as someone else pointed out, the US military does have a framework for how they name operations. They at least avoid sounding like our names in the software industry: https://youtu.be/y8OnoxKotPQ https://youtu.be/y8OnoxKotPQ :P
- sandworm101 2y ago
  They may seem cringe but, at least the military names, are usually part of an underlying lexicon that outsiders don't understand. Some are inside jokes, others are cover for classified names.
  - hombre_fatal 2y ago
    You'd think we as software developers would have more humility when judging how other people name things.
    - jachee 2y ago
      Yeah, really. Naming things is one of the n+1 Hard Problems of Computing.
- segasaturn 2y ago
  It's standard law enforcement PR. People who are serious about cybersecurity topics might shake their heads a little at the self-aggrandizing naming and Matrix "hacker" backgrounds, but they aren't the target audience. The target audience is for the mass public, to glamorize the police as the Good Guys who are going after the Bad Guys.
- chucksmash 2y ago
  "Endgame" was a word with an established meaning before Disney stuck it in the title of a superhero movie in 2019. The patch for "Operation Endgame" (in the screen cap at the top of the article) even shows chess pieces, not superheroes.
- deleted 2y ago
  [deleted]
sidewndr46 2y ago
when you make the rules you get decide what counts as a win. Ever seen those "million dollar drug busts" that have a small pile of drugs on the table?
twojacobtwo 2y ago
I think the article said another 8 are being placed on a most wanted list or are being pursued. So maybe 3 drops in the bucket? Assuming those are all master-control servers, how many would it take to make a significant difference? They're still monitoring and investigating transactions, so it seems likely the numbers will grow.
striking 2y ago
> Droppers remain such a critical, human-intensive component of nearly all major cybercrime enterprises that the most popular have turned into full-fledged cybercrime services of their own. By targeting the individuals who develop and maintain dropper services and their supporting infrastructure, authorities are hoping to disrupt multiple cybercriminal operations simultaneously. I presume the counterargument is that it's like someone took down Gmail or some other centralized service or something. Maybe the disrupted centralization will send a lot of operations scrambling, even if it was only a few hundred servers that were doing all the work.
- pluto_modadic 2y ago
  or to get criminals to swap to a bugged service. This happened before with a darknet market.
zamalek 2y ago
If entrapment is unprotected in a relevant jurisdiction, seized domains/servers could be used to disrupt or even unmask actors. Release a new dropper and make the payload build tool malware itself. Now these actors can't trust what they get from each other, even if they trust the person who is supposed to be in control of the service. That would be a radical departure from the status quo of boasting loudly and plastering seizure pages up everywhere, and the suggestion here is that they are trying different things.
- lupire 2y ago
  That's not entrapment.
- seanhunter 2y ago
  If a law enforcement official sets up a website offering to sell you an illegal product or service and you buy it, that's not entrapment. It's only entrapment if the police cause you to commit a crime you would not have committed otherwise. https://lawcomic.net/guide/?p=633 https://lawcomic.net/guide/?p=633
ProxCoques 2y ago
I was about to check Spamhaus's ROKSO list, as I recall it listed about 30 people on it who were/are collectively responsible for almost all email spam (but it's down https://www.spamhaus.org/faqs/rokso/ https://www.spamhaus.org/faqs/rokso/). If malware is anything like that, the number of actors may be quite small.

Cody-99 2y ago

>In addition, Europol released information on eight fugitives suspected of involvement in dropper services and who are wanted by Germany 4 people in the initial arrests. They already have arrest warrants for at least another 8. It seems they have arrested someone who provided a lot of infrastructure so it wouldn't surprise me if they were able to roll that into more arrests in the near future. >“It has been discovered through the investigations so far that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure sites to deploy ransomware,”

ASalazarMX 2y ago

Forget numbers, think Marvel's Endgame, envision cop superheroes from all over the world converging on the supervillain to enact justice and save civilization! I swear law enforcement and the military choose the cringest name codes, not much better than names kids would pick.

b112 2y ago
Government types do everything by committee and meeting, all responsibility for decisions is shared, everyone must agree. Thus nothing risky, edgy or creative makes it out of such meetings.
- red-iron-pine 2y ago
  lol what? have you seen what comes out of the corporate world lately?
nozzlegear 2y ago
> I swear law enforcement and the military choose the cringest name codes, not much better than names kids would pick. I have it on good authority that the people in law enforcement and the military — and indeed all humans in general — were in fact kids at one point. Maybe we all just like cool sounding codenames, even if some keyboard jockeys on a forum will call it “cringe”.
- ASalazarMX 2y ago
  I was a cringy kid too, but now I'm an adult that wouldn't call an official war strike "Operation Beastmaster" (real name from the Iraq invasion). Christ, how many years before we see names like "Operation CyBoRgDiNoSaUr"?
  - nozzlegear 2y ago
    > but now I'm an adult that wouldn't call an official war strike "Operation Beastmaster" (real name from the Iraq invasion). Why? That name’s dope. If you can’t give cool names to military operations of all things, then you can’t give cool names to anything. And as someone else pointed out, the US military does have a framework for how they name operations. They at least avoid sounding like our names in the software industry: https://youtu.be/y8OnoxKotPQ https://youtu.be/y8OnoxKotPQ :P
sandworm101 2y ago
They may seem cringe but, at least the military names, are usually part of an underlying lexicon that outsiders don't understand. Some are inside jokes, others are cover for classified names.
- hombre_fatal 2y ago
  You'd think we as software developers would have more humility when judging how other people name things.
  - jachee 2y ago
    Yeah, really. Naming things is one of the n+1 Hard Problems of Computing.
segasaturn 2y ago
It's standard law enforcement PR. People who are serious about cybersecurity topics might shake their heads a little at the self-aggrandizing naming and Matrix "hacker" backgrounds, but they aren't the target audience. The target audience is for the mass public, to glamorize the police as the Good Guys who are going after the Bad Guys.
chucksmash 2y ago
"Endgame" was a word with an established meaning before Disney stuck it in the title of a superhero movie in 2019. The patch for "Operation Endgame" (in the screen cap at the top of the article) even shows chess pieces, not superheroes.
deleted 2y ago
[deleted]

sidewndr46 2y ago

when you make the rules you get decide what counts as a win. Ever seen those "million dollar drug busts" that have a small pile of drugs on the table?

twojacobtwo 2y ago

I think the article said another 8 are being placed on a most wanted list or are being pursued. So maybe 3 drops in the bucket? Assuming those are all master-control servers, how many would it take to make a significant difference? They're still monitoring and investigating transactions, so it seems likely the numbers will grow.

striking 2y ago

> Droppers remain such a critical, human-intensive component of nearly all major cybercrime enterprises that the most popular have turned into full-fledged cybercrime services of their own. By targeting the individuals who develop and maintain dropper services and their supporting infrastructure, authorities are hoping to disrupt multiple cybercriminal operations simultaneously. I presume the counterargument is that it's like someone took down Gmail or some other centralized service or something. Maybe the disrupted centralization will send a lot of operations scrambling, even if it was only a few hundred servers that were doing all the work.

pluto_modadic 2y ago
or to get criminals to swap to a bugged service. This happened before with a darknet market.

zamalek 2y ago

If entrapment is unprotected in a relevant jurisdiction, seized domains/servers could be used to disrupt or even unmask actors. Release a new dropper and make the payload build tool malware itself. Now these actors can't trust what they get from each other, even if they trust the person who is supposed to be in control of the service. That would be a radical departure from the status quo of boasting loudly and plastering seizure pages up everywhere, and the suggestion here is that they are trying different things.

lupire 2y ago
That's not entrapment.
seanhunter 2y ago
If a law enforcement official sets up a website offering to sell you an illegal product or service and you buy it, that's not entrapment. It's only entrapment if the police cause you to commit a crime you would not have committed otherwise. https://lawcomic.net/guide/?p=633 https://lawcomic.net/guide/?p=633

ProxCoques 2y ago

I was about to check Spamhaus's ROKSO list, as I recall it listed about 30 people on it who were/are collectively responsible for almost all email spam (but it's down https://www.spamhaus.org/faqs/rokso/ https://www.spamhaus.org/faqs/rokso/). If malware is anything like that, the number of actors may be quite small.