The US has announced charges against 16 people behind DanaBot, a malware-as-a-service platform responsible for more than $50 million in damages worldwide.
“The FBI reports that a newer version of DanaBot was used for espionage and that many of the defendants revealed their true identities after accidentally infecting their systems with the malware,” he says KrebsOnSecurity:
Initially identified in May 2018 by researchers at email security firm Proofpoint, DanaBot is a malware-as-a-service platform that specializes in credential theft and banking fraud.
Today, the US Department of Justice announced a complaint and indictment from 2022, which said the FBI identified at least 40 associates who paid between $3.000 and $4.000 a month for access to the information-stealing platform.
The government says the malware infected more than 300.000 systems worldwide, causing more than $50 million in damage.
The leaders of DanaBot are Aleksandr Stepanov, 39, also known as “JimmBee,” and Artem Aleksandrovich Kalikin, 34, also known as “Onix.” Both are from Novosibirsk, Russia.
Kalikin is an IT engineer for the Russian state energy company Gazprom. His Facebook profile name is “Maffiozi.”
According to the FBI, there were at least two main versions of DanaBot.
The first was sold between 2018 and 2020, when the malware stopped being offered on Russian forums. The government alleges that the second version of DanaBot – which appeared in January 2021 – was released for use and targeted military, diplomatic and non-governmental computers in several countries, including the United States, Belarus, the United Kingdom, Germany and Russia.
The indictment says the FBI seized servers used by the DanaBot creators to control their malware in 2022, as well as servers that stored stolen victim data. The government said the server data also shows numerous instances in which the DanaBot defendants infected their own computers, resulting in their credentials being uploaded to stolen data repositories seized by federal authorities.
“In some cases, such self-infections appear to have been done intentionally to test, analyze, or improve the malware,” the complaint states.
"In other cases, the infections appear to have been unintentional."
A statement from the Department of Justice says that as part of the operation, agents from the Defense Criminal Investigative Service (DCIS) seized DanaBot's control servers, including dozens of virtual servers hosted in the United States.
The government says it is now working with industry partners to notify DanaBot victims and help remediate the infections.
The government thanks a number of security companies for their assistance (ESET, Flashpoint, Google, Intel 471, Lumen, PayPal, Proofpoint, Team CYRMU, and ZScaler).
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
