Microsoft and Europol announced a coordinated takedown targeting three major 'cybercrime as a service' operations, striking at the infrastructure behind Stealc, Amadey, and SocGholish malware strains. The action represents a novel approach focused on dismantling the entire cybercrime supply chain rather than individual actors.
Europol confirmed that more than 300 servers were targeted in the operation. The three malware families are known for enabling a range of criminal activities, from data theft to initial access brokerage, and are widely used by low-sophistication threat actors who purchase services rather than developing their own tools.
Stealc is an information-stealing malware that harvests browser credentials and cryptocurrency wallets, while Amadey functions as a loader that deploys additional payloads. SocGholish, often distributed through compromised websites as fake browser updates, serves as a gateway for ransomware groups.
Microsoft touted legal and technical measures against the command-and-control servers, with actions taken in multiple jurisdictions. The company emphasized that this supply-chain approach aims to make cybercrime less profitable by removing the foundational services attackers rely on.
Attribution for the operations remains unclear, but the takedown signals a growing willingness by law enforcement and private sector partners to target the infrastructure layer rather than chasing individual criminals. The impact on overall cybercrime activity will depend on whether the disrupted services are quickly rebuilt by their operators.