Greek police arrest Albanian national in Operation Endgame, dismantling malware that infected hundreds of thousands of computers worldwide.
ATHENS: Greece has arrested a 38-year-old man as part of a Europol crackdown on international cybercrime, during which authorities dismantled malware infrastructure that has infected hundreds of thousands of computers worldwide, police said.
The pan-European law enforcement cooperation agency Europol said on Thursday that in the latest phase of “Operation Endgame” across 10 countries, including the United States, it targeted infostealers Rhadamanthys, the Remote Access Trojan VenomRAT and the botnet Elysium.
The malware infrastructure dismantled this week consisted of hundreds of thousands of infected computers containing several million stolen credentials, Europol said. Many of the victims did not know that their systems were infected.
ALSO READ: Ukraine arrests top cybercrime forum admin with French-Europol aid
In total, 1,025 servers were taken down or disrupted worldwide and 20 domains were seized.
The man, an Albanian national arrested in Athens on November 3, is allegedly the creator and seller of VenomRAT since 2020, Greek police officials said. He was detained on a European arrest warrant issued by France.
“The main suspect behind the infostealer had access to over 100,000 crypto wallets belonging to these victims, potentially worth millions of euros,” Europol said.
Greek police said that the malware was designed to steal information through keystroke recording and the remote use of web cameras, text infiltration and cryptocurrency wallet hacking. The price for its use ranged from 150 euros a month to 1,550 euros a year.
After searching the man’s residence they said they found versions of malware source code, evidence pointing to the management of a website promoting the malware, suspicious emails and cryptocurrency accounts.
They have confiscated seven hard drives, three USB sticks and a digital wallet with cryptocurrencies worth $140,424 among other items, police said in a statement.
A Greek police official said that the digital infrastructure for the operation of the malware was hosted on a server of a company based in France, while French and U.S. authorities have also launched investigations. – Reuters
