National Crime Agency
Printable version |
Unprecedented UK operation aids global strike against Blackshades malware
Seventeen suspected users of software designed to take over, control and steal information from personal computers have been arrested in the first ever UK-wide cyber crime operation.
Coordinated by the National Crime Agency, a week of
arrests, searches and seizures has involved nearly every UK Regional Organised
Crime Unit (ROCU), as well as Police Scotland and the Metropolitan Police.
The arrests comprise:-
- A male in Derbyshire by the East Midlands Special Operations Unit (EMSOU)
- Four males by the West Midlands ROCU. These took place in Birmingham, Halesowen, Wolverhampton and Newcastle-under-Lyme respectively
- A male in Brixham, Devon, by ZEPHYR, the south west ROCU
- Two males by SEROCU, the south east ROCU. These took place in Andover, Hampshire, and Ashford, Kent respectively
- Four males by TITAN, the north west ROCU. Two took place in Liverpool, one in Manchester and one in Warrington.
- One male in Woodford Green, Essex, by ERSOU, the eastern ROCU.
- Two males, in St Andrews and Glasgow respectively, by Police Scotland
- One male in London by the Metropolitan Police
- One male in Leeds by the Yorkshire and Humberside ROCU
The
UK investigation forms part of global activity targeting the developers and
prolific users of Blackshades, a set of malware tools sold online for under
£100.
Initiated by the FBI and coordinated in Europe through Eurojust and the
European Cybercrime Centre (EC3) at Europol, police forces internationally have
apprehended dozens of suspected users.
The most common Blackshades product is a Remote Access Tool (RAT), which
enables cyber criminals to remotely take over and control the operations of an
infected computer and can be used to:
- Access the webcam of the victim, turning it on without the user’s knowledge and taking screen shots
- Access personal files and documents, and download new content
- Engage in unsolicited chat with the victim
- Infect USB devices to aid further spreading of malware
- Instruct the victim’s computer to help commit Distributed Denial of Service (DDOS) attacks
- Infect other computers via peer-to-peer communications
The
Blackshades inventory also includes a Password Recovery Application
designed to capture usernames and passwords inputted on a victim’s
machine. The criminal can then view the stolen data in a similar way to an
email inbox.
People are typically infected by clicking on external links on social
networking and communication platforms. Instead of viewing a picture or video,
the victim unwittingly installs the malware. In many cases, those affected will
have no indication they are infected.
Investigators believe that around 200,000 usernames and passwords of victims
across the world may have been extracted by Blackshades users in the
UK.
Andy Archibald, Deputy Director of the NCA’s
National Cyber Crime Unit, said:
“Criminals throughout the UK and across the world are finding out that
committing crimes remotely offers no protection from arrest. The unique scale
of this cyber operation shows what can happen when law enforcement agencies at
local, national and international level work together to tackle the
perpetrators and help keep people safe.
“Cyber crime is one of the most significant criminal threats to the UK.
The NCA is helping to build the capacity of its partners across the country and
coordinating the UK’s collective efforts as part of the response. The
commitment of our police partners in the cyber arena has been clearly
demonstrated by the work culminating in this week’s dramatic
activity.”
National Policing lead on e-crime, Deputy Chief Constable Peter Goodman,
said:
“This has been a superbly co-ordinated intelligence-led international
policing response to a specific emerging cyber crime threat, which could have
given offenders access to personal security information held by citizens of the
UK and overseas.
“It demonstrates the determination of the National
Crime Agency, its partners overseas and the UK’s newly-established
regional cyber crime units to identify, trace and disrupt those
whose potential criminal activity presents a threat to the
public’s lawful use of the intranet.
“It also sends out a clear
message to cyber criminals that we have the technology, capability and
expertise to track them down, and should, I hope, reassure the public that the
police can and will respond effectively to the reports we receive about the
criminal use of computer networks and malware to by-pass security measures we
rely on to keep our personal data safe.”
In addition to arresting people believed to have used Blackshades, the NCA is
using a variety of approaches to warn individuals who have downloaded the
malware but not deployed it that they are now known to the agency. Any movement
into criminality will result in further action.
The NCA urges members of the public to ensure they keep antivirus software
regularly updated, and to back up their computer and other elctronic
devices to ensure they can recover files, including important documents
and photographs. Further advice on internet safety can be found atGetsafeonline and Cyberstreetwise
Anyone who believes they have lost money through malware should report it
at www.actionfraud.police.uk