In a major victory for international cybersecurity efforts, a coordinated law enforcement operation codenamed “MORPHEUS” has successfully disrupted a significant cybercrime infrastructure built around the penetration testing tool Cobalt Strike. Led by the United Kingdom’s National Crime Agency (NCA) in collaboration with authorities from Australia, Canada, Germany, the Netherlands, Poland, and the United States, the operation targeted the malicious use of unlicensed Cobalt Strike versions.

Europol, the European Union’s law enforcement agency, played a vital role in coordinating this international effort, which commenced in 2021 and culminated in a decisive week of action from June 24th to 28th, 2024. During this intensive period, law enforcement successfully neutralized 590 out of the identified 690 servers associated with criminal activity. These servers, flagged to Online Service Providers (OSPs) across 27 countries, were effectively disabled, significantly disrupting the ability of cybercriminals to leverage Cobalt Strike for malicious purposes.

“Illegal versions of Cobalt Strike have helped lower the barrier of entry into cybercrime, making it easier for online criminals to unleash damaging ransomware and malware attacks with little or no technical expertise,” stated Paul Foster, Director of Threat Leadership at the NCA. This sentiment underscores the critical nature of this operation, highlighting the potential for legitimate tools to be weaponized by malicious actors. The dismantling of this infrastructure represents a crucial step in safeguarding organizations from ransomware attacks and a broad spectrum of cyber threats facilitated by Cobalt Strike.

The targeted infrastructure primarily utilized older, unlicensed versions of Cobalt Strike, often favored by cybercriminals due to their easier accessibility. As detailed in a recent report by Palo Alto Networks Unit 42, cybercriminals leverage a payload known as Beacon. This payload utilizes text-based profiles, referred to as Malleable C2, to manipulate the characteristics of Beacon’s web traffic, thereby attempting to evade detection by security measures.

While Cobalt Strike serves as a valuable tool for IT security professionals, facilitating adversary simulation and penetration testing to identify security vulnerabilities within their networks, its capabilities have been misused. Malicious actors have increasingly exploited cracked versions of the software, as identified by Google and Microsoft, for their own post-exploitation objectives. This highlights the concerning trend of legitimate security tools being weaponized by cybercriminals. 

In a separate, but significant development, Spanish and Portuguese law enforcement authorities successfully arrested 54 individuals involved in a vishing scam targeting elderly citizens. This criminal network employed a two-pronged approach:

1. Vishing Calls: Perpetrators, posing as bank employees, initiated fraudulent phone calls to victims. Through social engineering tactics, they convinced victims of fictitious issues with their bank accounts and tricked them into surrendering personal information.
2. In-Person Pressure: Following the phone call, other members of the network would visit the victims’ homes unannounced. Using intimidation tactics, they pressured the victims into divulging credit card details, PIN codes, and additional bank information. In some instances, the criminals directly stole cash and jewelry from the victims.

Europol reported that this elaborate scheme resulted in total losses exceeding €2,500,000 for the targeted individuals. The stolen funds were deposited into various Spanish and Portuguese accounts controlled by the network. Europol further revealed the existence of a “money laundering scheme” where these funds were channeled through a network of “money mules” overseen by specialized members of the organization. This laundering process aimed to obfuscate the origin of the stolen money.

Building on the momentum of international law enforcement efforts, INTERPOL recently dismantled human trafficking rings operating in several countries. Notably, in Laos, Vietnamese nationals were lured with promises of high-paying jobs but then coerced into creating fraudulent online accounts for financial scams. These victims were subjected to harsh working conditions, forced to work 12-hour days that extended to 14 hours if recruitment quotas weren’t met. Additionally, their travel documents were confiscated, further restricting their freedom. INTERPOL reported that families were extorted for sums as high as USD $10,000 to secure the victims’ return to Vietnam.

Last week INTERPOL coordinated a global law enforcement effort spanning 61 countries, codenamed “Operation First Light.” This large-scale initiative targeted online scam and organized crime networks, focusing on disrupting activities like phishing, investment fraud, fake online shopping sites, romance scams, and impersonation scams. The operation yielded significant results, leading to the arrest of 3,950 suspects and the identification of an additional 14,643 potential suspects across all continents. Furthermore, INTERPOL successfully seized assets valued at $257 million and froze 6,745 bank accounts associated with these criminal activities.

By dismantling this infrastructure, law enforcement has significantly hindered the ability of cybercriminals to launch attacks and maintain persistence within compromised networks. This successful operation exemplifies the ongoing collaboration between international law enforcement agencies and the private sector in the fight against cybercrime.