Operation Endgame (2024)
A Europol-coordinated operation in May 2024 against the dropper malware that paves the way for ransomware, described as the largest ever against botnets.
Before encryption, a ransomware attack almost always starts with a small dropper, installed through booby-trapped email, which then loads the attacker's tools. A few families of such malware dominated the criminal market. The operation went after them together, in several countries on the same day: arrests, seizures of servers and domain names, identification of those who profited. It follows the same logic as the Qakbot takedown, on a larger scale: attacking the crime supply chain rather than each group. Its effect on claim frequency is real but temporary, since criminal services rebuild, which insurers have to factor into how they read trends.
Between May 27 and 29, 2024, police forces coordinated by Europol and Eurojust went after IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot: four arrests, more than 100 servers taken down and more than 2,000 domain names seized. One of the main suspects is believed to have earned at least 69 million euros renting out this infrastructure.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.