Europol freezes $47 million in stolen cryptocurrency as it dismantles malware networks in Operation Endgame, highlighting the ongoing battle against cybercrime.
Operation Endgame Targets Cybercrime
Europol has successfully frozen over €41 million (approximately $47 million) in cryptocurrency linked to cybercrime during its latest initiative, Operation Endgame. This operation involved extensive international collaboration and focused on dismantling the infrastructure of three notable malware families—SocGholish, Amadey, and StealC—which are notorious for stealing sensitive information from cryptocurrency users.
During the two-week operation, law enforcement agencies managed to take down 326 servers and 142 domains, recovering about 27 million stolen credentials from more than 385,000 compromised systems. The operation's scope highlights the rising threat posed by malware targeting digital currency holders.
Malware Analysis
StealC, which has been operational since 2023, is designed to extract critical credentials such as passwords and crypto wallet information from infected devices. It even includes a feature to decrypt MetaMask wallet seed phrases. Meanwhile, Amadey is utilized to gain initial access and deliver additional malware, while SocGholish—associated with the infamous Russian group Evil Corp—spreads through fraudulent browser update prompts.
These malware strains have been linked to significant thefts, including account takeovers and ransomware incidents. Microsoft, a key partner in this operation, reported that during the early weeks of May, Amadey and StealC compromised over 140,000 computers worldwide.
Broader Context of Cyber Theft
The increasing prevalence of infostealers, which are primarily used for cryptocurrency theft, prompts ongoing concern. These malicious tools utilize deceptive tactics, including fraudulent software and pirated content, to target users. An earlier phase of Operation Endgame revealed that login credentials for over 100,000 crypto wallets had been stolen but remained unexploited.
Additionally, Microsoft’s Digital Crimes Unit has been actively pursuing legal action against malware operators. By analyzing the infrastructure shared between Amadey and StealC, they filed a racketeering lawsuit under the RICO Act, aiming to dismantle over 200 servers associated with these malicious activities.
Future Implications
While operations like these are crucial in combating cybercrime, malware developers often adapt and release new versions of their products shortly after takedowns. Europol and its partners are now notifying potential victims via platforms such as Have I Been Pwned, providing users an opportunity to check if their credentials have been compromised.
