In a significant blow to cybercrime, law enforcement agencies around the world have joined forces to disrupt several major operations, dealing a substantial setback to hackers and cybercriminals. The latest actions, which include the takedown of LeakBase, a major cybercrime forum, and Tycoon2FA, a phishing-as-a-service platform, demonstrate the effectiveness of international cooperation in combating cybercrime.
The FBI, in coordination with Europol, seized the LeakBase cybercrime forum, a major online platform used by cybercriminals to buy and sell hacking tools and stolen data. The operation, known as "Operation Leak," involved law enforcement agencies in 14 countries and resulted in the shutdown of LeakBase's domains, the posting of seizure banners, and the warning of LeakBase members. The seizure banner on the forum's domain notes that the database and all its content have been seized by the FBI.
In another major operation, Europol coordinated an international action that disrupted Tycoon2FA, a phishing-as-a-service platform linked to tens of millions of phishing messages each month. The operation, which was supported by Microsoft, Trend Micro, Cloudflare, Coinbase, Intel471, Proofpoint, Shadowserver Foundation, and SpyCloud, resulted in the seizure of 330 domains part of the platform's backbone infrastructure. The technical disruption was led by Microsoft, while seizure of infrastructure and other operational measures were carried out by law enforcement in Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom.
Meanwhile, a ransomware attack on the University of Mississippi Medical Center (UMMC) highlighted the devastating impact of cybercrime on critical infrastructure. The attack, which blocked access to electronic medical records and took down many of the medical center's IT systems, forced the cancellation of outpatient procedures, ambulatory surgeries, and imaging appointments. However, the medical center was able to resume normal operations nine days after the attack, thanks to the efforts of its Division of Information Systems.
In a related development, a brute force attack on a network exposed to the internet led to the unmasking of a ransomware infrastructure network. The attack, which was detected by the Huntress Tactical Response Team, revealed unusual credential-hunting behavior, a web of geo-distributed infrastructure, and a shady VPN service that all pointed toward a ransomware-as-a-service ecosystem and its initial access brokers.
The recent crackdown on cybercrime operations highlights the importance of international cooperation in combating cybercrime. As cybercrime continues to evolve and become more sophisticated, law enforcement agencies must work together to share intelligence and best practices to stay ahead of hackers and cybercriminals.
Sources:
- FBI seizes LeakBase cybercrime forum, data of 142,000 members (Source 1)
- Europol-coordinated action disrupts Tycoon2FA phishing platform (Source 3)
- Mississippi medical center reopens clinics hit by ransomware attack (Source 4)
- How a Brute Force Attack Unmasked a Ransomware Infrastructure Network (Source 5)
In a significant blow to cybercrime, law enforcement agencies around the world have joined forces to disrupt several major operations, dealing a substantial setback to hackers and cybercriminals. The latest actions, which include the takedown of LeakBase, a major cybercrime forum, and Tycoon2FA, a phishing-as-a-service platform, demonstrate the effectiveness of international cooperation in combating cybercrime.
The FBI, in coordination with Europol, seized the LeakBase cybercrime forum, a major online platform used by cybercriminals to buy and sell hacking tools and stolen data. The operation, known as "Operation Leak," involved law enforcement agencies in 14 countries and resulted in the shutdown of LeakBase's domains, the posting of seizure banners, and the warning of LeakBase members. The seizure banner on the forum's domain notes that the database and all its content have been seized by the FBI.
In another major operation, Europol coordinated an international action that disrupted Tycoon2FA, a phishing-as-a-service platform linked to tens of millions of phishing messages each month. The operation, which was supported by Microsoft, Trend Micro, Cloudflare, Coinbase, Intel471, Proofpoint, Shadowserver Foundation, and SpyCloud, resulted in the seizure of 330 domains part of the platform's backbone infrastructure. The technical disruption was led by Microsoft, while seizure of infrastructure and other operational measures were carried out by law enforcement in Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom.
Meanwhile, a ransomware attack on the University of Mississippi Medical Center (UMMC) highlighted the devastating impact of cybercrime on critical infrastructure. The attack, which blocked access to electronic medical records and took down many of the medical center's IT systems, forced the cancellation of outpatient procedures, ambulatory surgeries, and imaging appointments. However, the medical center was able to resume normal operations nine days after the attack, thanks to the efforts of its Division of Information Systems.
In a related development, a brute force attack on a network exposed to the internet led to the unmasking of a ransomware infrastructure network. The attack, which was detected by the Huntress Tactical Response Team, revealed unusual credential-hunting behavior, a web of geo-distributed infrastructure, and a shady VPN service that all pointed toward a ransomware-as-a-service ecosystem and its initial access brokers.
The recent crackdown on cybercrime operations highlights the importance of international cooperation in combating cybercrime. As cybercrime continues to evolve and become more sophisticated, law enforcement agencies must work together to share intelligence and best practices to stay ahead of hackers and cybercriminals.
Sources:
- FBI seizes LeakBase cybercrime forum, data of 142,000 members (Source 1)
- Europol-coordinated action disrupts Tycoon2FA phishing platform (Source 3)
- Mississippi medical center reopens clinics hit by ransomware attack (Source 4)
- How a Brute Force Attack Unmasked a Ransomware Infrastructure Network (Source 5)