European authorities take down SteaIC malware servers for second time this year
European police dismantled more than 100 servers used by the StealC password-stealing malware this week, marking the second such takedown after an initial crackdown in June.
German authorities on Thursday said investigators traced the rebuilt network to the Virtualine bulletproof hosting provider, seized by the FBI in October, with assistance from police in Frankfurt and the Dutch National High Tech Crime Unit. The operation targeted the StealC password-stealing malware, which has compromised over 40,000 victims.
Global Operation
Europol confirmed a wider international operation saw law enforcement agencies and private sector partners disrupt 235 servers and 257 domains used by StealC alongside the Gootloader and CastleRAT malware. Investigators uncovered copies of around 6.4 million stolen login credentials from victims worldwide.
Even technically skilled and well-organized cybercriminals must expect coordinated international investigations.
Previous Action
The authorities and Microsoft previously announced in June they dismantled hundreds of servers and domains linked to StealC and other malware tools. At that time, investigators restricted access to €41 million ($47 million) in cryptocurrency. No arrests, cryptocurrency seizures or criminal charges accompanied the latest action.
Next Steps
Police from nine countries, including Germany, the Netherlands, Britain and the United States, took part in the operation, which aims to target the most significant tools used by cybercriminals globally. Victims are encouraged to visit politie.nl/checkyourhack and haveibeenpwned.com to check if their credentials were compromised.
Related
