I Got a Remediation Request From Spamhaus. Now What?

Today's big news is Operation Endgame, which Brian Krebs describes as "a coordinated action against some of the most popular cybercrime platforms for delivering ransomware and data-stealing malware."¹ Law enforcement agencies and security organizations across several countries took part. For email providers, the part that matters is what comes next: Spamhaus is going to be contacting providers whose customers' accounts were compromised, and those providers need to know what to do with that message when it arrives.

Operation Endgame went after the malware delivery layer

The operation targeted botnets that criminals use to get ransomware and infostealers onto victims' machines in the first place.

• IcedID (also called Bokbot) started as a banking trojan and also works as a loader for other malware.
• Smokeloader is a generic backdoor whose capabilities depend on the modules in a given build. It is delivered several ways and is broadly associated with criminal activity like pay-per-install campaigns.
• SystemBC is modular malware used as a proxy, which helps other malware hide its traffic.
• Pikabot is command-and-control malware known for using steganography to conceal its payload.
• Bumblebee is a loader that delivers ransomware and other malicious software.

Spamhaus will be asking providers to clean up compromised accounts

Spamhaus's most visible role will be prompting providers to work through remediation with customers whose accounts were compromised. In its own words:

A significant part of operating cybercrime infrastructure like these botnets relies on the use of stolen credentials. Threat actors acquire these credentials by operating remote access tools (RATs) and infostealers; they then use these newly-compromised accounts to further spread malware, or to gain initial access into networks and organizations. These accounts have been shared with Spamhaus, who will help with remediating them.²

If you're a provider, verify the request before you act on it

If Spamhaus contacts you about compromised customer accounts, there are three things to do, in order.

1. Check that the message really came from Spamhaus. I would be shocked if some bad actor didn't try to use this moment to get their hooks into a provider's systems with a convincing lookalike.
2. Go to https://www.spamhaus.org/endgame and enter the access code from Spamhaus's email to get the list of affected accounts.
3. Work with your customers to secure those accounts. That means requiring a password change, and it would be very appropriate to require affected customers to check their machines for malware, since the credentials were stolen from an infected device in the first place.

Everyone else is here out of curiosity, and the advice for you is the usual advice, because it works. Keep your software patched, use a password manager and unique passwords, turn on two-factor authentication, and if your provider tells you to change a password because of a possible compromise, do it that day. The stolen credentials that fed these botnets came from machines whose owners thought none of this applied to them.