MalwarePublished 23 May 2025Updated 22 Jun 2025

Operation Endgame 2.0

Source AlienVault OTX General

Description

International law enforcement agencies have taken additional actions in Operation Endgame, targeting cybercriminal organizations, particularly those behind DanaBot. DanaBot is a powerful modular malware family written in Delphi, capable of keylogging, capturing screenshots, recording desktop videos, exfiltrating files, injecting content into web browsers, and deploying second-stage malware. It operates as a Malware-as-a-Service platform, enabling various attacks. DanaBot has been used in targeted attacks against government officials in the Middle East and Eastern Europe, and for DDoS attacks against Ukrainian servers. The malware implements a custom binary protocol encrypted with RSA and AES, and uses hardcoded C2 servers with Tor as a backup communication channel. Over 50 nicknames have been associated with DanaBot affiliates.

Impact

For European organizations, the impact of DanaBot can be significant, particularly for government entities, critical infrastructure, and sectors handling sensitive data. The espionage capabilities threaten confidentiality by enabling unauthorized access to sensitive communications and documents through keylogging and file exfiltration. Integrity may be compromised via browser content injection and deployment of secondary malware, potentially altering data or system behavior. Availability risks arise from DDoS attacks, which can disrupt services and operational continuity. The use of encrypted communications and fallback Tor channels complicates detection and mitigation, increasing the likelihood of prolonged undetected presence within networks. Given its MaaS nature, even less technically skilled threat actors can launch attacks, broadening the threat landscape. The targeting of Eastern European officials and Ukrainian infrastructure suggests a regional focus that could extend to European Union countries with geopolitical ties or shared interests. The modular design allows attackers to tailor payloads to specific targets, increasing the potential for customized, high-impact attacks against European organizations.

Defensive guidance

Mitigation should focus on a multi-layered defense strategy tailored to the specific tactics employed by DanaBot affiliates. First, implement robust endpoint detection and response (EDR) solutions capable of identifying behavioral indicators such as unauthorized keylogging, screen capture, and suspicious process injections. Network monitoring should include detection of anomalous encrypted traffic patterns and Tor usage, with the ability to flag or block unauthorized Tor connections. Employ strict application whitelisting and privilege management to limit execution of unauthorized binaries and reduce persistence opportunities. Regularly audit and harden credential storage and access controls to mitigate credential dumping risks. Incident response teams should develop playbooks for rapid containment and eradication of modular malware infections, including isolating affected systems and conducting forensic analysis to identify secondary payloads. Given the MaaS model, organizations should also engage in threat intelligence sharing with law enforcement and industry groups to stay informed about emerging affiliate tactics and infrastructure changes. Finally, user training should emphasize the risks of social engineering and the importance of cautious interaction with unsolicited content, as user interaction is often required for initial infection.

Indicators of compromise

Domains 1

y3wg3owz34ybihfulzr4blznkb6g6zf2eeuffhqrdvwdp43xszjknwad.onion

IP addresses 4

77.239.101.139
77.239.99.248
77.91.76.17
91.243.50.68

Hashes 8

0942af7805af433bc395ea765ebdb3dc
0d9f7daefcaea9e1e49edd921d6970b1
6ea28c3b21708f487dd1a798605fe9de63cfe47b
7bc53dbd360a132705a964e39a598e036f6627ee
2f8e0fc38eaf08a69653f40867dcd4cc951a10cd92b8168898b9aa45ba18a5c8
871862d1117fd7d2df907406a3ce08555196800b0ef9901dd4c46f82b728263d
75ff0334d46f9b7737e95ac1edcc79d956417b056154c23fad8480ec0829b079
e2c228d0bf460f25b39dd60f871f59ea5ef671b8a2f4879d09abae7a9d4d49fb

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2025, 17:35 UTC

MITRE ATT&CK techniques18 from threat tags

Technical details

Indicators of compromise

Domains 1

IP addresses 4

Hashes 8

Community reviews

Related threats