McAfee Labs Assists Dutch Police and Europol in Ransomware Ring Takedown

On December 20, Dutch Police and Europol announced Operation Bakovia, a coordinated effort to investigate and take down the actors behind CTB Locker, one of the most prominent ransomware families in 2015 and the top ransomware threat in 2016. McAfee Labs’ Advanced Threat Research team assisted the law enforcement agencies in the takedown via research analysis. Operation Bakovia culminated in the arrest of six people in East Romania allegedly responsible for spreading CTB Locker among other ransomware.

CTB Locker, also known as Critroni, is known as one of the largest ransomware families. According to McAfee, it is one of the primary drivers of the explosion in ransomware growth, which has almost tripled since Q1 2015 from just under 5 million total samples to more than 12 million in Q3 2017.

CTB Locker had been sold on the black market as an out-of-the-box hacking tool. In 2016 a wave of spam email carrying the virus under the guise of telecommunication bills attacked the Netherlands. This prompted Dutch authorities to investigate the ransomware, apporaching McAfee to assist.

“Today, a clear message has been sent—involvement in cybercrime is not zero risk. Last week an operation took place in which McAfee Labs’ Advanced Threat Research team played a role in the arrest of a cybercrime gang responsible for spreading CTB Locker and Cerber ransomware families,” said Raj Samani, Cheif Scientist at McAfee.

“These ransomware families claimed many victims in Belgium, Italy, the Netherlands, and the United States, and the arrests of the actors behind them is a significant takedown operation. The law enforcement action emphasizes the value of public-private partnerships.”

Samani’s statements refer to recently released McAfee Labs Threat Report: December 2017, in which hackers were anonymously interviewed. The hackers inclined to answer said they found hacking to be a safe and easy occupation.