How RCMP helped to take down Russia-based malware threat

Global disruption event

A global group of law enforcement agencies, including Germany, the Netherlands and the USA, was collaborating to stop the threat. When RCMP investigators joined the effort, they found the key to unlock the malware and wipe it out.

With that key in hand, RCMP Sergeant Warren Krahenbil, the officer in charge of the Cybercrime Investigation Team in Vancouver (CIT-V), and civilian criminal investigator Mike Siegel, lead investigator on the SocGholish file, travelled to Europe to join an international effort to squash the SocGholish bug. Civilian criminal investigators (CCI) in Vancouver had successfully reverse engineered how the malware worked. Now, global law enforcement and public partners were coming together, and they were going to turn the malware's techniques back on itself.

The plan was to disinfect the Internet using the malware's own operating commands, decrypted by police in the Netherlands. Krahenbil describes the collaboration as a "force multiplier" that leveraged the abilities of teams from different countries.

Together, their efforts cleaned 2,488 infected servers, while notifications were sent to the owners of 15,000 websites along with instructions to share with millions of infected users on how to clean their systems.

Civilian investigators show their value

"Canada took a leading role in an international file," says Krahenbil, "and it went well."

Indeed, the file showcased Canada's growing leadership in the fight against cybercrime. Using the expertise of CCI was part of what led them to success.

"Operation Endgame highlighted the value of employing civilians," says Krahenbil.

Rather than training police officers in computer sciences, the RCMP decided to recruit computer specialists and train them in police procedures.

"We bring in these civilian investigators who have degrees and education and specific skill sets in cyber," says Krahenbil. The result is Civilian Criminal Investigators who bring their expertise to the organization.

"The people that I've been able to bring here have been fantastic," he says

Zee Zhang and Mike Siegel, both RCMP CCIs from CIT-V, brought years of technical experience to the investigation, which they say was a blurry concept at first. Then, they identified a server in Canada that was part of the SocGholish network. They got a warrant to seize the server as evidence and started to analyze the technical logs. The large amounts of technical data collected from the seized server helped provide clues to how the Russian cybercriminals were operating.

What once was blurry started to come into focus.

"Every discovery led to a new question, and every answer led investigators closer to understanding how the malware worked," says Siegel.

When the investigators put it all together to figure out how SocGholish worked, they were able to initiate a strategy to stop it.

"It was a breakthrough moment, because we knew exactly what it was doing," says Zhang, "so we knew exactly what we needed to do to shut it down. Then it was just a matter of putting the brain power together and coming up with a solution."

RCMP translators, technical specialists and international partners all contributed to solving different pieces of the puzzle.

What is SocGholish

"SocGholish is a type of malware we call droppers and loaders, that open back doors into users' computers for follow-up viruses and ransomware that target high-value victims," says Emil, one of the German investigators who requested to keep his full name private for security reasons. "SocGholish was almost exclusively used to open doors to ransomware attacks."

The malware was distributed via fake browser updates, primarily by hacking websites using WordPress.

"Around forty percent of the websites on the Internet use WordPress," says Daan, of the Netherlands' National High Tech Crime Unit, who also requested to keep his full name private. The fake updates made users inadvertently install the malware.

"SocGholish is the thing that gets you to click on the link that infects your computer," says Krahenbil.

Once the malware is in place, it provides access for criminals to install ransomware—software that digitally locks down critical files, effectively kidnapping them—until victims pay thousands of dollars in ransom to get them back.

"Ransomware always use an entry point," says Daan. "And that's what SocGholish is."

"SocGholish is the botnet being used by the Russia-based Evil Corp cyber-criminal group," Daan says. "We've had several cases in the past where Evil Corp was the perpetrator."

An international effort

The collective law enforcement action to stop the SocGholish threat is part of a wider international investigation named Operation Endgame, the largest international operation ever undertaken to tackle the full range malware that enables ransomware attacks. It represents a new approach, coordinated by Europol and Eurojust, that tracks down the digital infrastructure used by criminals.

"It's novel; it's a really creative kind of operation, and it's a different way to target the cybercrime ecosystem," says Jayne Bieber, an RCMP cybercrime intelligence analyst deployed with the Joint Cybercrime Action Taskforce (JCAT) at Europol in the Netherlands.

European agencies, including the Netherlands High Tech Crime Unit and the German Criminal Police Office, Bundeskriminalamt, played a significant role in the action against SocGholish by contributing legal authorities, technical capabilities, and investigative resources.

Even though the RCMP eventually had a leading role in establishing the technical solution for the investigation, Emil notes that, early on, Canada had little participation in Operation Endgame.

Bieber says she recognized a strategic opportunity for Canada to get involved in Operation Endgame and pushed to ensure that Canada could contribute to the growing international effort.

"Helping secure Canada's participation in the operation was a highlight for me," says Bieber. "It was a unique experience—seeing the Canadian flag on the logo was the icing on the cake."

For Zhang and Siegel, the experience also left an impact.

"Putting the brainpower together and coming up with a solution was one of the most rewarding parts of the operation," says Zhang.

For Siegel, it was seeing months of work result in tangible outcomes that helped protect Canadians and strengthened global security.

"It was very valuable to bring everyone to the same table," says Emil. For his colleague Daan, the operation showed what is possible when countries work toward a common goal.

"Because cyber crime is becoming so worldwide, and servers are being used everywhere," Daan says. "Cyber criminals can reach across borders, into any country, from any country."

With the perpetrators being in Russia, there are limits to the success of the operation.

"What we can do is create awareness, let the criminals know that we know who they are, and help out the victims," he says.

Looking ahead

While this investigation dealt a significant blow to the criminals involved, Operation Endgame is not over.

"Cybercrimes are always evolving and a lot can change as it is a vast topic," says Krahenbil, adding that investigators around the world continue to look out for threats to online safety.

"How do we protect Canadian borders from something that can reach in digitally?" he asks. "We have international partners, and when one of us wins, we all do."

With technology ever changing and new ones, such as artificial intelligence (AI), popping up, Krahenbil says people need to stay informed and stay alert.

For expert advice, guidance, services and support on cyber security for Canadians, please visit the Canadian Centre for Cyber Security.