HIBP
Operation Endgame – 300 Widomaker.com Email Accounts Found Among 16.5M Compromised Accounts
What Happened?
Between May 27 and May 29, 2024, an international law enforcement operation, Operation Endgame, seized over 100 cybercrime servers worldwide. It’s being called the largest ever operation against botnets.
Approximately 300 (active and inactive) @widomaker.com email accounts, and passwords, were identified as having been potentially compromised for use by the Endgame cybercrime groups, sometime during the time period the groups were active. This means the affected users’ passwords were potentially compromised via remote access trojans (RATs) or info-stealers (malware installed on the users’ computers). To find out more, review the article and video, from Microsoft, about How malware can infect your PC…
According to Spamhaus, “The botnet operators in question relied on compromised accounts to target victims and spread malicious emails. If a receiver interacted with one of these emails, it is highly likely that their device was infected. As a result, they probably became part of the targeted botnets.”
More details on Operation Endgame may be found at the links below…
- [Bleeping Computer] Police seize over 100 malware loader servers, arrest four cybercriminals
- [Krebs on Security] ‘Operation Endgame’ Hits Malware Delivery Platforms
- [Europol] Largest ever operation against botnets hits dropper malware ecosystem
- [Troy Hunt / Have I Been Pwned (HIBP)] Operation Endgame
What Should I Do?
The easiest way to tell if your email address is in the Operation Endgame data, or other data breaches, is to sign up, for free, to be notified when your email address appears in known data breaches, or is found, via law enforcement action, to be compromised, like in the case of Operation Endgame. The Have I Been Pwned notification service is free to individuals. Visit the HIBP website, via the link below, then click “Notify me” to sign up for notifications.
Most importantly, if you find that your email address(es) is/are in the Operation Endgame data, or other data breaches, you should scan your computers (or other devices) for malware, and reset the passwords of the affected email accounts to prevent further abuse. You may Contact our office for assistance.
Check if you are a victim of the Qakbot Malware!
The Justice Department today announced a multinational operation involving actions in the United States, France, Germany, the Netherlands, the United Kingdom, Romania, and Latvia to disrupt the botnet and malware known as Qakbot and take down its infrastructure. [1]
On August 29th, 2023, the FBI provided Have I Been Pwned (HIBP) with 6.43M email addresses to help notify impacted victims of their exposure to the Qakbot malware. Anyone may check to see if their email address is included in the list of victims of the Qakbot malware via the HIBP notification service.
We recommend that everyone subscribes to the free notification service provided by Have I Been Pwned (HIBP) which can notify you if your email address is found in certain data breaches, including being in the Qakbot data.
Qakbot relied on compromised accounts to spread its malicious emails. If a receiver interacted with one of these emails, it is highly likely that their device became infected. As a result, they would have become part of the Qakbot botnet. [2]
If you find that your email address is in the Qakbot data, meaning your computer was probably infected with the malware, you should take several actions, including resetting your email password, and resetting any other passwords that were used on the infected computer (banking, shopping, etc.). Also, it’s possible your computer is infected with other additional malware, it should be scanned by a reputable antivirus/anti-malware product such as Malwarebytes or Windows Defender. Since Qakbot targets, among other things, banking/financial details, you should carefully review bank statements for unauthorized transactions and report any you find to your financial institution.
