The U.S. Division of Justice (DoJ) on Thursday introduced the disruption of the net infrastructure related to DanaBot (aka DanaTools) and unsealed prices in opposition to 16 people for his or her alleged involvement within the growth and deployment of the malware, which it mentioned was managed by a Russia-based cybercrime group.
The malware, the DoJ mentioned, contaminated greater than 300,000 sufferer computer systems around the globe, facilitated fraud and ransomware, and brought on a minimum of $50 million in damages. Two of the defendants, Aleksandr Stepanov (aka JimmBee), 39, and Artem Aleksandrovich Kalinkin (aka Onix), 34, each from Novosibirsk, Russia, are presently at massive.
Stepanov has been charged with conspiracy, conspiracy to commit wire fraud and financial institution fraud, aggravated id theft, unauthorized entry to a protected laptop to acquire data, unauthorized impairment of a protected laptop, wiretapping, and use of an intercepted communication. Kalinkin has been charged with conspiracy to realize unauthorized entry to a pc to acquire data, to realize unauthorized entry to a pc to defraud, and to commit unauthorized impairment of a protected laptop.
The unsealed legal grievance and indictment present that lots of the defendants, counting Kalinkin, uncovered their real-life identities after unintentionally infecting their very own methods with the malware.
“In some circumstances, such self-infections seemed to be intentionally finished with a purpose to take a look at, analyze, or enhance the malware,” the grievance [PDF] learn. “In different circumstances, the infections gave the impression to be inadvertent – one of many hazards of committing cybercrime is that criminals will generally infect themselves with their very own malware by mistake.”
“The inadvertent infections typically resulted in delicate and compromising information being stolen from the actor’s laptop by the malware and saved on the DanaBot servers, together with information that helped establish members of the DanaBot group.”
If convicted, Kalinkin is predicted to face a statutory most sentence of 72 years in federal jail. Stepanov would face a jail time period of 5 years. Concurrent with the motion, the regulation enforcement effort, carried out as a part of Operation Endgame, noticed DanaBot’s command-and-control (C2) servers seized, together with dozens of digital servers hosted in the USA.
“DanaBot malware used a wide range of strategies to contaminate sufferer computer systems, together with spam e-mail messages containing malicious attachments or hyperlinks,” the DoJ mentioned. “Sufferer computer systems contaminated with DanaBot malware turned a part of a botnet (a community of compromised computer systems), enabling the operators and customers of the botnet to remotely management the contaminated computer systems in a coordinated method.”
 |
| Instance of typical Danabot infrastructure |
DanaBot, just like the not too long ago dismantled Lumma Stealer malware, operates below a malware-as-a-service (MaaS) scheme, with the directors leasing out entry ranging from $500 to “a number of thousand {dollars}” a month. Tracked below the monikers Scully Spider and Storm-1044, is a multi-functional instrument alongside the traces of Emotet, TrickBot, QakBot, and IcedID that is able to appearing as a stealer and a supply vector for next-stage payloads, equivalent to ransomware.
The Delphi-based modular malware is provided to siphon information from sufferer computer systems, hijack banking periods, and steal system data, consumer looking histories, saved account credentials, and digital forex pockets data. It could actually additionally present full distant entry, log keystrokes, and seize movies. It has been lively within the wild since its debut in Might 2018, when it began off as a banking trojan.
“DanaBot initially focused victims in Ukraine, Poland, Italy, Germany, Austria, and Australia previous to increasing its concentrating on posture to incorporate U.S.- and Canada-based monetary establishments in October 2018,” CrowdStrike mentioned. “The malware’s recognition grew resulting from its early modular growth supporting Zeus-based net injects, data stealer capabilities, keystroke logging, display screen recording, and hidden digital community computing (HVNC) performance.”
In response to Black Lotus Labs and Staff Cymru, DanaBot employs a layered communications infrastructure between a sufferer and the botnet controllers, whereby the C2 visitors is proxied by means of two or three server tiers earlier than it reaches the ultimate stage. At the very least 5 to 6 tier-2 servers had been lively at any given time. A majority of DanaBot victims are concentrated round Brazil, Mexico, and the USA.
“The operators have proven their dedication to their craft, tailored to detection and modifications in enterprise protection, and with later iterations, insulating the C2s in tiers to obfuscate monitoring,” the businesses mentioned. “All through this time, they’ve made the bot extra user-friendly with structured pricing and buyer assist.”
 |
| Variety of DanaBot campaigns noticed in Proofpoint e-mail menace information from Might 2018 to April 2025 |
Telemetry information gathered by Proofpoint reveals that DanaBot was “almost completely absent” from the e-mail menace panorama from July 2020 by means of June 2024, indicating that menace actors propagated the malware by means of different strategies like search engine optimisation poisoning and malvertising campaigns.
The DoJ mentioned DanaBot directors operated a second model of the botnet that was specifically designed to focus on sufferer computer systems in army, diplomatic, authorities, and associated entities in North America and Europe. This variant, rising in January 2021, got here fitted with capabilities to report all interactions occurring on a sufferer system and ship the info to a unique server.
“Pervasive malware like DanaBot harms a whole bunch of 1000’s of victims around the globe, together with delicate army, diplomatic, and authorities entities, and causes many tens of millions of {dollars} in losses,” mentioned United States Legal professional Invoice Essayli for the Central District of California.
 |
| Excessive-level diagram of multi-tiered C2 structure |
The DoJ additional credited a number of personal sector companies, Amazon, CrowdStrike, ESET, Flashpoint, Google, Intel 471, Lumen, PayPal, Proofpoint, Spycloud, Staff Cymru, and Zscaler, for offering “priceless help.”
A few of the noteworthy features of DanaBot, compiled from varied reviews, are under –
- DanaBot’s sub-botnet 5 acquired instructions to obtain a Delphi-based executable leveraged to conduct HTTP-based distributed denial-of-service (DDoS) assaults in opposition to the Ukrainian Ministry of Defence (MOD) webmail server and the Nationwide Safety and Protection Council (NSDC) of Ukraine in March 2022, shortly after Russia’s invasion of the nation
- Two DanaBot sub-botnets, 24 and 25, had been particularly used for espionage functions seemingly with an purpose to additional intelligence-gathering actions on behalf of Russian authorities pursuits
- DanaBot operators have periodically restructured their providing since 2022 to deal with protection evasion, with a minimum of 85 distinct construct numbers recognized up to now (The latest model is 4006, which was compiled in March 2025)
- The malware’s infrastructure consists of a number of elements: A “bot” that infects goal methods and performs information assortment, an “OnlineServer” that manages the RAT functionalities, a “consumer” for processing collected logs and bot administration, and a “server” that handles bot technology, packing, and C2 communication
- DanaBot has been utilized in focused espionage assaults in opposition to authorities officers within the Center East and Japanese Europe
- The authors of DanaBot function as a single group, providing the malware for lease to potential associates, who subsequently use it for their very own malicious functions by establishing and managing their very own botnets utilizing personal servers
- DanaBot’s builders have partnered with the authors of a number of malware cryptors and loaders, equivalent to Matanbuchus, and provided particular pricing for distribution bundles
- DanaBot maintained a mean of 150 lively tier-1 C2 servers per day, with roughly 1,000 each day victims throughout greater than 40 international locations, making it one of many largest MaaS platforms lively in 2025
Proofpoint, which first recognized and named DanaBot in Might 2018, mentioned the disruption of the MaaS operation is a win for defenders and that it’ll have an effect on the cybercriminal menace panorama.
“Cybercriminal disruptions and regulation enforcement actions not solely impair malware performance and use but additionally impose a value to menace actors by forcing them to alter their techniques, trigger distrust within the legal ecosystem, and doubtlessly make criminals take into consideration discovering a unique profession,” Selena Larson, a workers menace researcher at Proofpoint, mentioned.
“These successes in opposition to cyber criminals solely come about when enterprise IT groups and safety service suppliers share much-needed perception into the most important threats to society, affecting the best variety of individuals around the globe, which regulation enforcement can use to trace down the servers, infrastructure, and legal organizations behind the assaults. Non-public and public sector collaboration is essential to figuring out how actors function and taking motion in opposition to them.”
 |
| DanaBot’s options as promoted on its assist website |
DoJ Unseals Expenses In opposition to QakBot Chief
The event comes because the DoJ unsealed prices in opposition to a 48-year-old Moscow resident, Rustam Rafailevich Gallyamo, for main efforts to develop and preserve the QakBot malware, which was disrupted in a multinational operation in August 2023. The company additionally filed a civil forfeiture grievance in opposition to over $24 million in cryptocurrency seized from Gallyamov over the course of the investigation.
“Gallyamov developed, deployed, and managed the Qakbot malware starting in 2008,” the DoJ mentioned. “From 2019 onward, Gallyamov allegedly used the Qakbot malware to contaminate 1000’s of sufferer computer systems around the globe with a purpose to set up a community, or ‘botnet,’ of contaminated computer systems.”
The DoJ revealed that, following the takedown, Gallyamov and his co-conspirators continued their legal actions by switching to different techniques like “spam bomb” assaults with a purpose to achieve unauthorized entry to sufferer networks and deploy ransomware households like Black Basta and CACTUS. Court docket paperwork accuse the e-crime group of partaking in these strategies as not too long ago as January 2025.
“Mr. Gallyamov’s bot community was crippled by the proficient women and men of the FBI and our worldwide companions in 2023, however he overtly continued to deploy different strategies to make his malware obtainable to legal cyber gangs conducting ransomware assaults in opposition to harmless victims globally,” mentioned Assistant Director in Cost Akil Davis of the FBI’s Los Angeles Discipline Workplace.
