Ransomware networks allegedly responsible for extorting hundreds of millions of dollars have been dismantled in a massive cybercrime crackdown.
A specialist team took down more than 100 servers and seized control of over 2,000 internet domains across the globe.
The operation — dubbed Endgame — was coordinated by the European Union's judicial cooperation agency Eurojust.
It involved police agencies in Europe and America.
Four "high value" suspects were arrested during the raids — three in Ukraine and one in Armenia.
Police have now warned cybercriminals no one is untraceable.
What we know about the operation
The operation involved coordinated action in Germany, the Netherlands, France, Denmark, Ukraine, the United States and United Kingdom, Eurojust said.
Searches were carried out in Ukraine, Portugal, the Netherlands and Armenia, leading to the arrest of four people.
It is the latest international operation aimed at disrupting malware and ransomware operations.
What is ransomware?
Ransomware is a form of malware and involves a malicious software designed to block access to a computer system until a sum of money is paid.
It is often sent via phishing emails that contain a link to an infected website.
When a user clicks on the link, malware is downloaded and installed without their knowledge. Hackers can then steal data, encrypt it, or lock the device.
This operation targeted malware "droppers" called IcedID, Pikabot, Smokeloader, Bumblebee and Trickbot.
A dropper is malicious software usually spread in emails containing infected links or attachments such as shipping invoices or order forms.
What did the ransomware network allegedly do?
Police allege the computer networks were responsible for spreading ransomware and other malicious software via infected emails.
The financial damage inflicted by the network on governments, companies and individual users is estimated to be hundreds of millions of dollars.
"Millions of people are also victims because their systems were infected, making them part of these botnets," Dutch police said.
Eurojust said one of the main suspects earned cryptocurrency worth around 69 million euros ($112 million) by renting out criminal infrastructure for spreading ransomware.
"The suspect's transactions are constantly being monitored and legal permission to seize these assets upon future actions has already been obtained," EU police agency Europol added.
Cybercriminals warned they will be caught
Stan Duijf, of the Dutch National Police, warned cybercriminals no one is untraceable.
"This operation shows that you always leave tracks, nobody is unfindable, even online," he said.
Ben Jones, CEO at Searchlight Cyber, a company that provides intelligence on the dark web, said the operation proved cybercrime could be tackled with international cooperation.
"Where cybercriminals previously used their ability to operate across borders to evade the arm of justice, operations like Endgame — coordinated across multiple jurisdictions — demonstrate that this evasion tactic is increasingly untenable.
"Law enforcement's net is widening and the 'safe zones' for cybercriminal activity are becoming harder and harder to come by."
What happens next?
Europol said this would not be the last take-down and more action would be announced soon.
German authorities are seeking the arrest of seven people on suspicion of being members of a criminal organisation whose aim was to spread the Trickbot malware.
An eighth person is suspected of being one of the ringleaders of the group behind Smokeloader.
The eight suspects being sought by Germany will be added to Europol's most-wanted list.
ABC/AP
