The European Cybercrime Centre (EC3) at Europol strengthens the law enforcement response to cybercrime in the European Union and helps protect European citizens, businesses and governments. Its focus is on cybercrimes:
The Internet Organised Crime Threat Assessment (IOCTA) is Europol’s flagship annual strategic assessment of Internet-related organised crime. It informs decision makers on prioritisation of actions in the field of high-tech crimes, online child sexual exploitation and online payment fraud, and offers a forward looking, strategic overview of the cybercrime landscape. The 2015 IOCTA provides primarily a law enforcement perspective, combined with input from private industry, the financial sector and academia, which makes it unique compared to many private sector assessments.
The 2015 IOCTA reported how cybercrime is becoming more aggressive and confrontational. There is a shift from hidden, stealthy intrusions towards direct, confrontational contact between criminals and victims. This is seen across the various forms of cybercrime, including high-tech crimes, data breaches and sexual extortions. Aggressively confronting victims is the trademark of traditional organised crime groups who have turned to cybercrime for its high profits6.
Darkode was one of the most prolific English-speaking cybercriminal forums in the world, used to trade and barter hacking expertise, malware and botnets, Zero Day Exploits, access to compromised servers, and to find partners for spam campaigns or malware attacks. The forum was a closed community of 250-300 active users. To join, potential candidates had to be invited and vetted by a trusted member of the forum.
Europol played a central coordination role in the takedown of Darkode, facilitating law enforcement activities prior to and during the actual operational action. Europol set up a dedicated command post with a direct secure communication link to the command centre in the US which was used to orchestrate the work effectively on the ground.
Participants:
Results: 28 individuals arrested, 37 houses searched, computers and other equipment seized.
On 24 February 2015, Europol coordinated a joint international operation to target the Ramnit botnet7 that had infected 3.2 million computers around the world. This botnet was used by criminals to gain remote control of infected computers, primarily to steal passwords and disable antivirus protection. The malware, infecting users running Windows operating systems, exploited different infection methods such as links contained in spam emails. Representatives from the Member States’ law enforcement services, Microsoft, Symantec and Anubis Networks worked together with Europol officials to shut down command and control servers and to redirect 300 Internet domain addresses used by the botnet's operators.
Participants:
On 18 and 19 June, Europol’s European Cybercrime Centre and Eurojust were involved in a coordinated action in Ukraine - joint investigation team (JIT) Mozart. JIT Mozart is one of the most complex cross-border cybercrime investigations that EC3 has to date supported, entailing more than 16 000 man-hours of investigative work, the exchange of more than 1700 operational messages, and intensive analysis of a large volume of complex data. EC3 supported the investigation by establishing the overall intelligence picture, and identifying crucial links between the malware attacks and the different investigations. Furthermore, Europol’s analytical work and forensic analysis helped to link the suspects to the actual crimes and to identify the high-value top targets. Both Eurojust and Europol provided funding for the JIT. The substantial volume of data collected and processed during the investigation is still being used to trace the cybercriminals still at large, and has to date generated multiple hits with other high-profile cybercrime investigations.
Participants:
On 9 June 2015, the joint international operation Triangle led to the dismantling of a group of cybercriminals active in Belgium, Italy, Poland, Spain, the United Kingdom and Georgia. These cybercriminals were suspected of committing financial fraud involving email account intrusions. Operation Triangle resulted in the arrest of 49 suspects, 58 properties were searched, and numerous laptops and tablets, hard disks, telephones, SIM cards, memory sticks, forged documents, credit cards, cash, and bank account documents were seized. It was coordinated by Europol and Eurojust, led by the Italian Postal and Communications Police, the Spanish National Police, the Polish Police Central Bureau of Investigation, and supported by UK law enforcement bodies. The Joint Cybercrime Action Taskforce (J-CAT) at Europol also supported the operation.
