Europol: RAT malware stops working after coordinated police action

The UK’s National Crime Agency, with support from Europol, has coordinated a police action that rendered a remote access trojan called LuminosityLink inoperable and unavailable. The malware is said to have claimed thousands of victims.

Europol and the National Crime Agency report that a small network of British individuals distributed the malware. They sold LuminosityLink to about 8,600 buyers in 78 different countries, a survey found. The NCA writes, “Research activities have rendered the tool unavailable and unusable by those who purchased it.” The organization does not provide further details on how this result was achieved.

For example, it is possible that the investigative services got their hands on the command and control infrastructure behind the malware. The sale of the tool is said to have come to light after an arrest in September 2016 of a person in Bristol and the subsequent investigation of a seized computer. Investigative services from thirteen European countries, the US and Australia participated in the investigation.

The malware cost about $40 and could be used to monitor victims by tracking keystrokes, accessing the webcam, and stealing files. According to the NCA, the malware was also able to disable security software and exercise full control over an infected system. Little technical knowledge would be required to use the malware.