International police boffins take down ‘most dangerous botnet’

A combined international police force has seized thousands of computers running one of the world’s most dangerous hacking networks that netted its controllers millions of dollars from innocent computer users.

The Emotet network obtained access to victims’ computers via malicious email attachments, then sold that access to criminals who installed more dangerous malware.

Police IT experts from the UK, EU, US and Canada worked together to disrupt Emotet and find its designers.

Europol called it “one of most significant botnets of the past decade” and one of the main “door openers” to computer systems worldwide.

It said in a statement, “Once this unauthorised access was established, these were sold to other top-level criminal groups to deploy further illicit activities such as data theft and extortion through ransomware.”

Dmitry Smilyanets, from Recorded Future, said: “A working botnet is a very complicated and gentle system. Even if the creator and his support and operators are not arrested, they likely will not try to rebuild. They have enough cash to retire in peace or start a new criminal adventure.”

Emotet was initially a banking trojan, designed to spy on victims’ computers and steal login details.

Victims would receive an apparently important Word document attachment marked for their attention. When opened, it would ask them to “enable Macros” – a seemingly innocent feature built into Microsoft Word.

It was that action which actually opened their computer up to attackers, enabling them to access financial details and other critical and potentially lucrative personal information.

Lotem Finkelstein, of Check Point Software, said his company had been tracking Emotet for years. “It was the most successful and prevalent malware of 2020 by a long way. It constantly adjusted its phishing emails to victims’ interests and global events – for example, the Covid-19 pandemic or major shopping seasons such as Black Friday.”

He said that its demise “would protect the public from cyber-threats that have caused losses of millions, if not more, of dollars”.