It Was a Good Month for Fighting Cybercrime. Don't Get Comfortable

As ransomware attacks across the United States and around the world reached a fever pitch in 2021, private companies and governments made their most extensive promises yet to address and deter such attacks and dismantle the cybercriminal ecosystem. A flurry of activity in recent weeks highlights progress on these efforts. But cybercrime is still at an all-time high, and researchers warn that there is no single holistic solution.

The Department of Justice announced last Tuesday the takedown of RaidForums, a marketplace for sensitive stolen data like usernames and passwords, Social Security numbers, and individuals' financial information. They also said they had charged RaidForums’ alleged founder and chief administrator, 21-year-old Diogo Santos Coelho of Portugal, and arrested him in the United Kingdom on January 31. A day later, Microsoft said it had disrupted the ZLoader botnet, a favorite malware distribution platform for ransomware actors that include the Ryuk gang, which is known for targeting hospitals and other health care organizations. Microsoft even chose to name the alleged developer of one ZLoader component, who lives on the Crimean Peninsula, “to make clear that cybercriminals will not be allowed to hide behind the anonymity of the internet to commit their crimes.” And during the first week of April, German law enforcement working with US agencies announced the takedown of Russian-language dark web market Hydra. In addition to offering a platform to sell drugs and other elicit goods, Hydra was a major cybercriminal money-laundering and cash-out hub.

Dark web market and botnet takedowns have been going on for years, but the escalating pace and scale of these interventions is noteworthy. After the Hydra takedown, for example, researchers found that users were concerned about how to replace its services and whether they would be able to trust new sites that could simply be fronts for law enforcement.