Europol action against Avalanche malware network leads to arrests

An action by Europol has led to the arrest of five suspects who may have belonged to a group that used the Avalanche infrastructure. This network allowed criminals to distribute spam and malware as part of phishing campaigns.

Europol collaborated with the FBI in the campaign against internet criminals and coordinated it from the European Cybercrime Center in The Hague. In total, more than thirty countries were involved in the action. In addition to the five arrests, 37 searches were carried out, 39 servers were seized and 221 servers were taken offline. As many as 800,000 domains were seized, blocked or used as sinkholes.

Avalanche was estimated to consist of an average of half a million infected systems every day, which were exploited for spam, malware and phishing. The damage caused by the network is estimated by Europol in the ‘hundreds of millions of euros’. Thanks to the use of double fast flux, the network was able to withstand take-downs from servers and domains. This is a DNS technique in which IP addresses are quickly switched for both the DNS records and the authoritive name servers, which makes mapping and frustrating the network difficult.

Up to 20 different malware families were distributed through Avalanche, including goznym, marcher, and pandabanker. The network was also used in combination with money mules, people who make their bank account available for scams. Phishing criminals use goods purchased through these accounts to launder money.