#ESETresearch joins Europol’s Cyber Intelligence Extension Programme (CIEP) We are proud to announce ESET’s participation in the pilot phase of CIEP, a new initiative launched by Europol 's European Cybercrime Centre (EC3).
The program aims to strengthen public-private cooperation in the fight against cybercrime by enabling real-time collaboration and intelligence sharing. ESET Chief Research Officer Roman Kovac & Senior Malware Researcher Jakub Soucek, spent several days at Europol’s HQ.
ESET has already cooperated in EC3's Advisory Group, where we are represented by ESET Senior Research Fellow Righard Zwienenberg. ESET has also contributed to successful law enforcement operations: #Gamarue, #RedLine, #Grandoreiro, #LummaStealer #Danabot.
The new CIEP initiative elevates this collaboration further, creating opportunities for direct, real-time engagement with Europol’s operational teams. Partnerships like this one are crucial in mitigating risks within today's rapidly evolving cyber threat landscape.
Cyber threats evolve rapidly, but through these partnerships, so does our collective defense. Together we can make Europe a safer place.

In May 2025, #ESET participated in operations that largely disrupted the infrastructure of two notorious infostealers: #LummaStealer and #Danabot.
As part of the Lumma Stealer disruption effort, carried out in conjunction with Microsoft, BitSight, Lumen, Cloudflare, CleanDNS, and GMO Registry, ESET supplied technical analysis and statistical information.
Danabot was targeted by the #FBI and #DCIS, alongside #OperationEndgame led by #Europol and #Eurojust. ESET participated together with several other companies. We provided the analysis of the malware’s backend infrastructure and identified its C&C servers.
Before these takedowns, both infostealers were on the rise: in H1 2025, Lumma Stealer detections grew by 21%, while Danabot’s numbers increased by more than 50%.
For a time, Lumma Stealer was the primary payload of HTML/FakeCaptcha trojan, used in the #ClickFix social engineering attacks that we also cover in this issue of the #ESETThreatReport. In recent months, we have seen Danabot being delivered via ClickFix as well.
For more details on these two operations and on the ClickFix attacks, read the latest #ESETThreatReport: https://welivesecurity.com/en/eset-research/eset-threat-report-h1-2025

Zazwyczaj donoszę Wam (oczywiście uprzejmie) o wyciekach, kradzieżach, szpiegostwie i innych bezpiecznikowych katastrofach. Ale dziś? Mamy dwie gigantyczne wygrane w wojnie z cyberprzestępcami - i to z polskim akcentem!

W nowym odcinku opowiadam o spektakularnym rozbiciu LummaStealera i ciosie wymierzonym w Danabota - dwóch złośliwych bestiach, które przez lata truły życie firmom i zwykłym użytkownikom na całym świecie. Jak działały? Jak je rozpracowano? Jakie miało to konsekwencje?

I co najważniejsze - jak w ogóle wygląda "fraud-as-a-service" od kuchni, łącznie z cenami, dokumentacją i obsługą klienta 24/7?

Odcinek przygotowany przy współpracy z ESET i DAGMA Bezpieczeństwo IT

Zapraszam
https://youtu.be/fcTdhBq4U88

#DanaBot #malware operators exposed via C2 bug added in 2022

https://www.bleepingcomputer.com/news/security/danabot-malware-operators-exposed-via-c2-bug-added-in-2022/

Recently Disrupted DanaBot Leaked Valuable Data for 3 Years https://www.securityweek.com/recently-disrupted-danabot-leaked-valuable-data-for-3-years/ #Malware&Threats #DanaBot #botnet

Recently Disrupted DanaBot Leaked Valuable Data for 3 Years https://www.securityweek.com/recently-disrupted-danabot-leaked-valuable-data-for-3-years/ #Malware&Threats #DanaBot #botnet

Researchers warn of a surge in #ClickFix scams impersonating #Booking.com. Fake CAPTCHAs trick users into running malware like XWorm and DanaBot.

Read: https://hackread.com/clickfix-email-scam-fake-booking-com-emails-malware/

Latest issue of my curated #cybersecurity and #infosec list of resources for week #21/2025 is out!

It includes the following and much more:

UAE Recruiting US Personnel Displaced by #DOGE to Work on #AI for its Military;

Madhu Gottumukkala New Deputy Director of #CISA;

New metric called Likely Exploited Vulnerabilities (LEV) introduced;

European Union sanctions Stark Industries for enabling #cyberattacks;

@signalapp now blocks #Microsoft Recall screenshots on #Windows 11;

The #FBI and #Europol have disrupted the Lumma Stealer #malware network;

#DanaBot malware operation taken down;

Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end

https://infosec-mashup.santolaria.net/p/infosec-mashup-21-2025

Operation Endgame Takes Down DanaBot Malware, Neutralizes 300 Servers https://hackread.com/operation-endgame-danabot-malware-neutralizes-servers/ #OperationEndgame #Cybersecurity #CyberCrime #Security #TrickBot #Malware #DanaBot #Europol #Botnet #Qakbot

U.S. Authorities Seize DanaBot Malware Operation, Indict 16 – Source: securityboulevard.com https://ciso2ciso.com/u-s-authorities-seize-danabot-malware-operation-indict-16-source-securityboulevard-com/ #SecurityBoulevard(Original) #OperationEndgameCybercrime #rssfeedpostgeneratorecho #CyberSecurityNews #SecurityBoulevard #Threats&Breaches #Identity&Access #NetworkSecurity #CloudSecurity #Cybersecurity #datasecurity #DataPrivacy #Spotlight #endpoint #FEATURED #DanaBot #Malware #botnet #Russia

Operation Endgame Takes Down DanaBot Malware, Neutralizes 300 Servers – Source:hackread.com https://ciso2ciso.com/operation-endgame-takes-down-danabot-malware-neutralizes-300-servers-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #OperationEndgame #cybersecurity #CyberCrime #Hackread #security #TrickBot #DanaBot #Europol #malware #botnet #Qakbot

#OperationEndgame: Police takes down DanaBot malware network; 300 servers neutralized, €21.2M in crypto seized and 16 charged/

Read: https://hackread.com/operation-endgame-danabot-malware-neutralizes-servers/

Feds Charge 16 Russians Allegedly Tied to Botnets Used in #Ransomware, Cyberattacks, and Spying

https://www.wired.com/story/us-charges-16-russians-danabot-malware/

Operation Endgame is BACK! This time targeting #BumbleBee, #Latrodectus, #DanaBot, #WarmCookie, #Qakbot and #Trickbot!

Once again this is a HUGE win, with a truly international effort!

As with phase one of #OperationEndgame, Spamhaus are providing remediation support - those affected will be contacted in due course with steps to take.

For more information, read our write-up here:
https://www.spamhaus.org/resource-hub/malware/botnets-disrupted-worldwide-operation-endgame-is-back/

DanaBot Botnet Disrupted, 16 Suspects Charged https://www.securityweek.com/danabot-botnet-disrupted-by-law-enforcement-16-suspects-charged/ #Malware&Threats #lawenforcement #Featured #takedown #DanaBot #malware #botnet

DanaBot Botnet Disrupted, 16 Suspects Charged https://www.securityweek.com/danabot-botnet-disrupted-by-law-enforcement-16-suspects-charged/ #Malware&Threats #lawenforcement #Featured #takedown #DanaBot #malware #botnet

Oops: DanaBot Malware Devs Infected Their Own PCs https://krebsonsecurity.com/2025/05/oops-danabot-malware-devs-infected-their-own-pcs/ #DefenseCriminalInvestigativeService #ArtemAleksandrovichKalinkin #U.S.DepartmentofJustice #Russia'sWaronUkraine #Ne'er-Do-WellNews #AleksandrStepanov #ALittleSunshine #LummaStealer #Flashpoint #proofpoint #microsoft #teamcyrmu #Intel471 #Maffiozi #DanaBot #JimmBee #Zscaler #google #Paypal #Lumen #DCIS #ESET #Onix #fbi

Oops: DanaBot Malware Devs Infected Their Own PCs - The U.S. government today unsealed criminal charges against 16 individuals accused... https://krebsonsecurity.com/2025/05/oops-danabot-malware-devs-infected-their-own-pcs/ #defensecriminalinvestigativeservice #artemaleksandrovichkalinkin #u.s.departmentofjustice #russiaswaronukraine #aleksandrstepanov #neer-do-wellnews #alittlesunshine #lummastealer #flashpoint #proofpoint #microsoft #teamcyrmu #intel471 #maffiozi #danabot #jimmbee #dcis

Oops: DanaBot Malware Devs Infected Their Own PCs

https://krebsonsecurity.com/2025/05/oops-danabot-malware-devs-infected-their-own-pcs/

#DefenseCriminalInvestigativeService #ArtemAleksandrovichKalinkin #U.S.DepartmentofJustice #Russia'sWaronUkraine #Ne'er-Do-WellNews #AleksandrStepanov #ALittleSunshine #LummaStealer #Flashpoint #proofpoint #microsoft #teamcyrmu #Intel471 #Maffiozi #DanaBot #JimmBee #Zscaler #google #Paypal #Lumen #DCIS #ESET #Onix #fbi

The #FBI and #DCIS disrupted #Danabot. #ESET was one of several companies that cooperated in this effort. https://www.welivesecurity.com/en/eset-research/danabot-analyzing-fallen-empire/
#ESETresearch has been involved in this operation since 2018. Our contribution included providing technical analyses of the malware and its backend infrastructure, as well as identifying Danabot’s C&C servers. Danabot is a #MaaS #infostealer that has also been seen pushing additional malware – even #ransomware, such as #LockBit, #Buran, and #Crisis – to compromised systems.
We have analyzed Danabot campaigns all around the world and found a substantial number of distinct samples of the malware, as well as identified more than 1,000 C&Cs.
This infostealer is frequently promoted on underground forums. The affiliates are offered an administration panel application, a backconnect tool for real-time control of bots, and a proxy server application that relays the communication between the bots and the C&C server.
IoCs are available in our GitHub repo. You can expect updates with more details in the coming days. https://github.com/eset/malware-ioc/tree/master/danabot