Attributed metadata history

A Global Public-Private Partnership Just Got Preemptive

Alongside the NCA, DOJ, FBI, Meta, and partners across 10 countries, Silent Push mapped adversary infrastructure behind West African scam centers during Joint Disruption Week in London. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Every scam center requires digital infrastructure to operate: domains, hosting, and a steady stream of fresh accounts to scam new victims in various ways. Such operations can quickly go dark when a massive-scale, collaborative law enforcement effort disrupts those components.  That principle drove Silent Push’s role in Joint Disruption Week, a coordinated international operation called Operation Blackout, aimed at criminal scam networks operating out of West Africa. Hosted by the UK’s National Crime Agency (NCA) in London, the effort brought law enforcement and private industry together to share intelligence in real time and act on it. This operation led to a significant number of positive results, including the complete disruption of multiple fraud and scam centers, assets identified to freeze, identification of the operators across multiple African countries with subsequent arrests, and most importantly, the rescue of over 100 people trafficked against their will to work in fraud and scam centers successfully identified and located. How Silent Push Contributed to Operation Blackout: Infrastructure Identification and Mapping We supported the operation with what we do best: infrastructure identification, tracking changes to that infrastructure, and correlating across specific activity and linkages observed for a complete picture of the digital infrastructure that keeps fraud and scam center operations running.  Our team mapped the domains, hosting, and even the communication channels these networks depend on, then paired that mapping with attribution analysis to trace activity back to physical locations and the people operating them. We shared certain findings exclusively with law enforcement. Our additional results included: Silent Push identified and verified 37,041 financial crime domains detected over the past year The team built 70+ detection rules and mapped them to this criminal network’s patterns and processes. The recon work performed exposed 173 very high-risk critical infrastructure nodes. Silent Push identified 679 operator handles used across a variety of scam tactics. The team also shared 11 intelligence reports with partners involved in the operation. This is what Indicators of Future Attack (IOFA®) demonstrate. Instead of waiting for a scam domain to show up in a victim complaint, we fingerprint the infrastructure patterns criminals rely on and flag new assets as they stand up. This gives law enforcement a map of where a network is going, not just where it has been. A Global Coalition Built for Speed The NCA hosted the operation in partnership with the U.S. Department of Justice, the FBI, and several U.S. federal agencies. Those included the DOJ’s Scam Center Strike Force, the U.S. Secret Service, the Department of the Treasury, Homeland Security Investigations, and the Homeland Security Task Force. The group worked with Nigerian and Ghanaian authorities, INTERPOL, and law enforcement from Australia, Canada, India, and New Zealand. On the industry side, Silent Push joined Meta, Adobe, Binance, Chainalysis, Coinbase, Cyjax, Elliptic, Flashpoint, Google, Microsoft, OpenAI, Starlink, and TRM Labs. Meta played a central role in coordinating private sector participation. The disruption culminated in a week of joint work in London, building on months of investigation that continues. Investigators and industry partners traded intelligence across platforms, jurisdictions, and financial systems, then moved against scam centers in Nigeria,

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.