A website linked to more than 4m cyber-attacks worldwide, including against some of Britain’s biggest banks, has been shut down following a UK- and Netherlands-led operation.
Webstresser.org had 136,000 registered users and could be rented for about £10 to launch distributed denial of service (DDoS) attacks, in which high volumes of internet traffic are launched at target computers to disable them.
Following an investigation led by the UK’s National Crime Agency (NCA) and the Dutch national police, servers were seized at 11.30am on Wednesday in the Netherlands, the US and Germany, effecting a takedown of the website.
Suspected members of the group were arrested on Tuesday in Scotland, Canada and Serbia, the NCA said. Croatian police said they had arrested a 19-year old man who faces charges of criminal acts against computer systems. The operation was supported by Europol and Police Scotland, as well as law enforcement in 11 countries.
NCA officers also raided a property in Bradford, where the agency believed a suspect linked to the address used the Webstresser service to target seven of the UK’s biggest banks in attacks in November last year. The banks, which have not been named by investigators, were forced to reduce their operations or shut down entire systems, incurring costs in the hundreds of thousands.
Jo Goodall, senior investigating officer at the NCA, said: “A significant criminal website has been shut down and the sophisticated crime group behind it stopped as a result of an international investigation involving law enforcement agencies from 11 countries.“The arrests made over the past two days show that the internet does not provide bulletproof anonymity to offenders and we expect to identify further suspects linked to the site in the coming weeks and months as we examine the evidence we have gathered.”
Individuals with little or no technical knowledge could use the Webstresser service to launch crippling cyber-attacks across the world.
Other targets have included government institutions and police forces, as well as victims in the gaming industry.
Gert Ras, the head of the national hi-tech crime unit at the Dutch police, said: “By taking down the world’s largest illegal DDoS seller in a worldwide joint law-enforcement operation based on NCA intelligence, we have made an unprecedented impact on DDoS cybercrime. Not only were the administrators of this illegal service arrested, but also users will now face prosecution and civil liability for caused damage.
“This is a warning to all wannabe DDoS-ers: do not DDoS because, through close law-enforcement collaboration, we will identify you, bring you to court and facilitate that you will be held liable by the victims for the huge damage you cause.”
Europol’s European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce (J-Cat) supported the investigation by assisting the exchange of information between all partners. A command-and-coordination post was set up at Europol’s headquarters in The Hague, in the Netherlands, on the action day.
