Story perspectives

U.S. Indicts 16 in $50M DanaBot Malware Operation

5/23/2025

46 10

Summary

Justice Indicts Cybercriminals

The U.S. Department of Justice indicted 16 individuals connected to the DanaBot malware, affecting over 300,000 computers worldwide and causing $50 million in damages.
Originally a banking trojan, DanaBot has transformed into a malware-as-a-service platform linked to cybercrime and espionage.
Key suspects, Aleksandr Stepanov and Artem Kalinkin, are located in Novosibirsk, Russia, where the malware was developed.
This operation is part of Operation Endgame, an international initiative against cybercriminal organizations.

Summary

Microsoft Disrupts Malware

Microsoft’s Digital Crimes Unit disrupted Lumma Stealer, seizing 2,300 domains and affecting over 394,000 infected Windows computers globally.
Developed by Russian hacker “Shamel,” Lumma operates as malware-as-a-service, enabling customization and resale of stolen data.
The operation involved collaboration with the U.S. Department of Justice, Europol, and cybersecurity firms, showcasing effective public-private partnerships.
Lumma targets various sectors, including education and healthcare, demonstrating adaptability and stealth in evading detection.
Ongoing FBI investigations and further domain seizures aim to dismantle Lumma’s infrastructure.

History

Historical Context

The recent indictments of individuals linked to DanaBot and Lumma Stealer malware reflect a growing trend in cybercrime, reminiscent of the 2000s when malware became a significant threat. The rise of malware-as-a-service parallels earlier developments in organized crime, highlighting the need for international cooperation, as seen in past efforts against cybercriminal networks like Operation Bot Roast in 2006.

1 of 3

Justice Indicts Cybercriminals

The U.S. Department of Justice indicted 16 individuals connected to the DanaBot malware, affecting over 300,000 computers worldwide and causing $50 million in damages.
Originally a banking trojan, DanaBot has transformed into a malware-as-a-service platform linked to cybercrime and espionage.
Key suspects, Aleksandr Stepanov and Artem Kalinkin, are located in Novosibirsk, Russia, where the malware was developed.
This operation is part of Operation Endgame, an international initiative against cybercriminal organizations.

1 / 3