Major Cybercrime Arrests and Takedowns Mark 2024 Law-Enforcement Push
Summary
A 2024 roundup covers arrests and operations targeting LockBit, Snowflake breach suspects, Scattered Spider members and botnet infrastructure, while noting that cybercriminal groups continue to operate.
Key points
- Operation CRONOS disrupted LockBit infrastructure, exposed its leader’s identity and took the group’s dark web site offline temporarily, according to the article.
- Canadian authorities arrested Alexander Connor Moucka in connection with alleged compromises of Snowflake customer accounts; the U.S. also charged John Binns in connection with the breaches.
- Several people associated with Scattered Spider faced wire fraud and identity theft charges, officials said; the group is linked to phishing and social engineering attacks.
- Europol’s Operation Endgame targeted botnet droppers, seized hundreds of servers and made multiple arrests, according to the article.
- The article reports that Russian authorities arrested Mikhail Matveev, who has been charged by the U.S. in connection with attacks involving LockBit, Babuk and Hive.
- The roundup concludes that cybercriminal groups may continue operating in altered forms despite arrests and disruption operations.
Article Details
- Event Type
- 2024 law enforcement arrests and disruption operations targeting ransomware groups, botnets, and dark web criminal activity.
- Impact
- Operation CRONOS disrupted LockBit infrastructure and exposed the identity of its leader. Operation Endgame resulted in arrests and the seizure of hundreds of servers while targeting botnet droppers. Authorities also arrested or charged individuals in cases involving Snowflake customer data theft, Scattered Spider, and dark web drug marketplaces. The article reports at least 100 Snowflake customers affected by data exfiltration and the sale of stolen information.
People
Ahmed Hossam Eldin ElbadawyAmong the individuals arrested and charged in connection with Scattered Spider activity.Alexander Connor MouckaArrested by Canadian authorities, accused of compromising multiple Snowflake cloud storage accounts.Dmitry Yuryevich KhoroshevIdentified by the Operation CRONOS investigation as the leader of LockBit.Evans Onyeaka OsieboAmong the individuals arrested and charged in connection with Scattered Spider activity.Joel Martin EvansAmong the individuals arrested and charged in connection with Scattered Spider activity.John BinnsCharged by the United States in connection with the Snowflake breaches.Mikhail Pavlovich MatveevArrested in Russia and charged in connection with ransomware attacks, including attacks involving LockBit, Babuk, and Hive.Noah Michael UrbanAmong the individuals arrested and charged in connection with Scattered Spider activity.Ross UlbrichtIdentified as the owner of Silk Road; the article reports that President Trump pardoned him.Rui-Siang LinArrested for operating Incognito Market, a dark web narcotics marketplace.Tenzin OrgilSentenced to 168 months in prison for participating in a dark web drug-trafficking enterprise.Tyler Robert BuchananAmong the individuals arrested and charged in connection with Scattered Spider activity.
Threat Actors
LockBitRansomware group targeted by Operation CRONOS; the article also links Matveev to LockBit attacks.Mikhail Pavlovich MatveevArrested in Russia and accused of involvement in cybercrimes and ransomware attacks.Scattered SpiderLoosely affiliated group described as conducting cyber and ransomware attacks, including sophisticated phishing and social engineering.
Malware
BabukAccording to the FBI MATVEEV is linked to several ransomware variants, including LockBit, Hive and Babuk.BumbleBeeAccording to Europol, between 27 and 29 May 2024 Operation Endgame targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot.HiveAccording to the FBI MATVEEV is linked to several ransomware variants, including LockBit, Hive and Babuk.IcedIDAccording to Europol, between 27 and 29 May 2024 Operation Endgame targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot.PikabotAccording to Europol, between 27 and 29 May 2024 Operation Endgame targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot.SmokeLoaderAccording to Europol, between 27 and 29 May 2024 Operation Endgame targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot.SystemBCAccording to Europol, between 27 and 29 May 2024 Operation Endgame targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot.TrickBotAccording to Europol, between 27 and 29 May 2024 Operation Endgame targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot.
Products
Countries
RussiaA prominent figure in the ransomware community, Mikail Pavlovich Matveev was arrested in Russia for his involvement in cybercrimes against Russian entities.United StatesHe has allegedly conducted significant attacks against both United States and worldwide businesses, including critical infrastructure.