DanaBot Malware Network Dismantled: 16 Charged in $50 Million Global Operation

On 23 May 2025, the United States Department of Justice (DoJ) announced the dismantling of the online infrastructure associated with DanaBot, a sophisticated malware strain also known as DanaTools. At the same time, charges against 16 individuals were made public over their alleged involvement in developing and distributing the malware, which was controlled by a Russia-based cybercriminal organisation.

Multifunctional malware with a global impact

DanaBot infected more than 300,000 computers worldwide, facilitating fraud and ransomware attacks and causing estimated losses of at least $50 million. Two defendants, Aleksandr Stepanov (alias JimmBee), aged 39, and Artem Aleksandrovich Kalinkin (alias Onix), aged 34, both from Novosibirsk, Russia, remain at large.

The malware operated under a malware-as-a-service (MaaS) model, with access rented out for between $500 and several thousand dollars per month. DanaBot, tracked under the codenames Scully Spider and Storm-1044, is a multifunctional tool similar to Emotet, TrickBot, QakBot and IcedID, capable of acting as an information stealer and as a delivery mechanism for subsequent payloads, including ransomware.

Infection methods and malware capabilities

DanaBot used various methods to infect victims' computers, including spam emails containing malicious attachments or hyperlinks. Infected computers became part of a botnet, enabling operators to control them remotely in a coordinated manner.

The modular malware, written in Delphi, could extract data from victims' computers, hijack banking sessions and steal device information, browsing histories, saved account credentials and cryptocurrency wallets. It could also provide full remote access, log keystrokes and capture video.

Operation Endgame: international cooperation against cybercrime

The law-enforcement action, part of Operation Endgame, resulted in the seizure of DanaBot's command-and-control (C2) servers, including dozens of virtual servers hosted in the United States. Several international agencies cooperated in the operation to combat cybercriminal activity worldwide.

Fatal mistakes: hackers infect themselves

One unusual finding of the investigation was that some members of the DanaBot organisation accidentally infected themselves with their own malware, allowing investigators to collect incriminating data from their computers. This information helped identify members of the organisation.

Conclusion

The dismantling of the DanaBot network represents a significant step in the fight against international cybercrime. However, the evolving nature of these threats demands continued vigilance and global cooperation to prevent and counter future malicious activity.

Source: https://thehackernews.com/2025/05/us-dismantles-danabot-malware-network.html?utm_source=chatgpt.com