Investigators who took control of infrastructure used by three malware networks found another constituency for their work inside the seized systems. The records held credentials stolen from victims, some of whom may first learn of the theft through a notification service. Europol reported the recovery of 6.4 million victim datasets on November 12. It did not give a count of distinct people or companies represented in those records.
The joint operation reached both the infrastructure criminals controlled and websites belonging to others. In the portion targeting Gootloader, investigators and private partners remediated 681 infected websites. A compromised site could expose its visitors to malicious downloads while its legitimate owner continued to operate it. Cleaning those sites addressed a different problem from seizing the domains the malware operators used.
The other two targets presented different risks to victims. CastleRAT gave outsiders remote control over infected machines. StealC collected material such as passwords that could retain value after the operators lost a server. Europol says partners including Have I Been Pwned and the Shadowserver Foundation will help put information recovered in the operation to use in victim alerts.
What a recovered record can establish
For a company receiving an alert, the date of the seizure and the date an account was exposed answer different questions. An account may have changed hands or gained new privileges in the interval. The practical value of the recovered record lies in matching it to the right account and reconstructing what access it carried. That work can continue well after the distribution network goes offline.