Authorities Take Down Vendor of Extensively Used RAT Malware – Supply: www.govinfosecurity.com

Cybercrime
,
Fraud Management & Cybercrime
,
Malware as-a-Service

2 Males Arrested in Malta, Nigeria for Hawking Malware on Hacking Boards Since 2012

Cal Harrison •
February 9, 2024

Federal authorities have seized internet domains and arrested two men in Malta and Nigeria who they say served as sales and customer service reps for a dark web business that sold RAT malware to cybercriminals over a 12-year period, leading to the “takeover and infection of computers worldwide.”

See Also: Live Webinar | Securing the Cloud: Mitigating Vulnerabilities for Government

In response to a U.S. Justice Division assertion on Friday, authorities in Malta arrested Daniel Meli, 27, of Zabbar, Malta, on Feb. 7 on the DOJ’s request. Meli, who made his preliminary look earlier than a Justice of the Peace choose in Valletta, Malta, is going through fees from a federal grand jury indictment within the U.S. District Court docket for the Northern District of Georgia on Dec. 12 for inflicting unauthorized harm to protected computer systems, illegally promoting and promoting an digital interception machine, and taking part in a conspiracy to commit a number of pc intrusion offenses.

Authorities said he marketed, bought and maintained two extensively used strains of malware – Warzone RAT and an earlier model generally known as the Pegasus RAT – in on-line computer-hacking boards since not less than 2012.

“Specifically, Meli allegedly assisted cybercriminals seeking to use RATs for malicious purposes and offered teaching tools for sale, including an eBook,” the DOJ stated. “He sold through an online criminal organization called Skynet-Corporation. He also provided online customer support to purchasers of both RATs.”

Authorities in Boston seized www.warzone.ws and three associated domains that “sold the Warzone remote access Trojan, which gives cybercriminals the ability to” browse sufferer file programs, take screenshots, document keystrokes, steal sufferer usernames and passwords, and watch victims via their net cameras.”

FBI brokers in Massachusetts covertly purchased and analyzed the Warzone RAT malware
and confirmed its malicious capabilities, in response to courtroom paperwork.

Additionally arrested on Feb. 7 was Prince Onyeoziri Odinakachi, 31, of Nigeria, by the Port Harcourt Zonal Command of Nigeria’s Financial and Monetary Crimes Fee. A federal grand jury within the U.S. District Court docket for the District of Massachusetts on Jan. 30 indicted Odinakachi for conspiracy to commit a number of pc intrusion offenses, together with acquiring licensed entry to protected computer systems to acquire data and inflicting unauthorized harm to protected computer systems. The DOJ stated that between June 2019 and March 2023, Odinakachi offered clients with on-line help for Warzone RAT.

The takedown encompassed a world legislation enforcement operation led by FBI particular brokers in Boston and Atlanta and coordinated via Europol. Legislation enforcement businesses in Canada, Croatia, Finland, Germany, the Netherlands and Romania helped safe the servers internet hosting the Warzone RAT infrastructure.

“Today’s actions targeting the Warzone RAT infrastructure and personnel are another example of our tenacious and unwavering commitment to dismantling the malware tools used by cybercriminals,” stated Joshua S. Levy, the appearing U.S. lawyer for the District of Massachusetts.