A complex international operation involving the FBI and law enforcement agencies around the world has resulted in a major breakthrough: The alleged operator of the NetWire has been taken into custody. In addition, his web domain and hosting server have been seized by authorities.
See also: RedEyes: Uses M2RAT malware to steal data from Windows and phones
A Trojan (or RAT) is a type of malware that allows an attacker to gain access to computer over the internet. The attacker can then use the remote connection to monitor activity on the system, download files, execute programs, or even steal data and passwords.
NetWire, a malicious remote access trojan disguised as a legitimate Windows-based remote computer administration tool, has caused significant damage. Worldwiredlabs.com offers users a convenient subscription service for just $10 per month, which also includes access to services .
Since 2014, NetWire has become a popular tool for cybercriminal activities ,such as phishing campaigns, business email compromise attacks, and corporate network infiltration. Malicious actors can leverage the Netwire RAT to take control of Windows, remotely capturing screenshots and files. In addition, they are able to execute commands or download additional software to run on infected systems.
See also: New Python RAT malware targets Windows in attacks
On Tuesday, March 3, a seizure warrant was approved by the U.S. Attorney's Office for the Central District of California to disrupt and disable NetWire as part of an international law enforcement operation being conducted around the world.
The joint operation, conducted by the FBI, the United States Attorney's Office for the Central District of California, the Croatian Ministry of the Interior's Criminal Police Directorate, the Zurich Cantonal Police, Europol, and the Australian Federal Police, had a successful conclusion.
During this operation, law enforcement seized the domain worldwiredlabs.com used to promote their services, and Swiss police seized the server hosting site.
This website has been taken down as part of a joint law enforcement effort against the NetWire Remote Access Trojan. A seizure message is now displayed, alerting visitors to this targeted attempt.
See also: RAT malware campaign uses multilingual files to avoid detection
On Tuesday, Croatian authorities arrested a national suspected of being the administrator of the NetWire website, who will now face criminal prosecution in Croatia.
Donald Alway, the Assistant Director in Charge of the FBI's Los Angeles Field Office, said that by eliminating the Netwire RAT, the FBI has dealt a deep blow to cybercriminals everywhere.
