Behind the Scenes of How Operation Blackout Went Down

A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same.

Pushes for public-private partnerships to address escalating cyber threats have been on the industry’s radar for years. Collaboration has been a focal point in cybersecurity conference panels and government initiatives. Calls for more information-sharing and analysis centers have been persistent.

As director of preemptive cyberdefense at Silent Push, Michael Sweeney had a front-row seat to this kind of partnership when his company recently took part in “Operation Blackout,” a coordinated international operation to take down criminal networks operating out of West Africa. Operation Blackout coordinated efforts by the United Kingdom’s National Crime Agency, the U.S. Department of Justice, the Federal Bureau of Investigation, and private industry partners — including Meta, Microsoft, OpenAI, and Silent Push — to disrupt criminal networks behind pig-butchering, romance, and cryptocurrency scams. The DoJ announced that the campaign resulted in dozens of arrests, the rescue of trafficking victims, and the removal of more than 3.7 million fake social media accounts.

As the UK’s main law enforcement agency, the National Crime Agency hosted Joint Disruption Week in London in early October to bring together the DOJ and the FBI with private industry partners to share real-time intelligence. In addition to U.S. authorities and private industry partners, the Nigerian Joint Case Team on Cybercrimes, the Nigeria Police Force – National Cybercrime Center, and Ghanaian Cyber Security Authority also participated.

The Joint Disruption Week marked the first coordinated effort specifically focused on West Africa, according to the DOJ, which noted that global commitments are essential to dismantling the far-reaching scam centers.

The goal of these operations is to tackle scam activity at the global scale it has reached today, explains Sweeney. The more people who participate, the “better off we are,” he affirms.

“The idea is not only to stop the current scams, but also to look across all of these different events,” Sweeney tells Dark Reading. ” We’re [industry and government] all needed together in order to get this successfully taken down.”

Why You Should Report Scams

Data taken from scams reported through the FBI’s Internet Complaint Center and the UK’s National Cyber Security Centre formed the initial basis for Operation Blackout. From there, law enforcement compiled information, including the domains the scammers used and the infrastructure they set up to manipulate people for money.

Then the collaboration really began. Meta provided some of the data that helped drill down to specific regions — a surprising move, since social media platforms don’t generally cooperate with law enforcement, despite threat actors abusing platforms to lure in victims. Several other organizations sent signals to further paint a picture of the attacker’s intent and infrastructure.

Silent Push’s role involved providing 35,000 domains, creating more than 70 detection rules to trigger alerts when malicious activity occurs, and fingerprinting, Sweeney says. All of those are considered the “common choke points” that help researchers and authorities map the threat actors’ network patterns.

All of that was analyzed, and the data augmented each other to provide the evidence authorities needed to take down the scammers, says Sweeney.

“Once you get everyone in the room with all the data, it becomes easier to see the big picture,” he says. “From that, see where the attacks are coming from, the commonalities, and who is the most important person to take down in the operation, and where you want to go to get these people.”

“Let’s Go Faster”

Sweeney attributed the success of Operation Blackout and other operations he’s worked on over the years to how clear the mission was; everyone was on the same page about the goals and importance of data sharing, he says. Many of the legal or jurisdiction blockers that would otherwise prevent them from sharing information and hinder actual action were removed, including data-sharing agreements with users.

A number of providers were also involved, including Starlink. While each platform offers different services, they united in a shared stance. That camaraderie and energy that accompanied it were palpable, says Sweeney.

“We come together [to] say, ‘If you’re abusing our services, we’re going to do everything we can to stop you, and we’re going to pull in law enforcement,'” he says.

One thing Sweeney would like to change was the pace; he would like to see these partnerships move faster and conduct more operations as scammers drain billions from the U.S. economy. Threat actors who exploit vulnerable populations and employ highly deceptive social engineering tactics are only improving faster with the help of artificial intelligence.

What draws him to this work is the people who just reported a scam or who’re too ashamed to come forward at all. They should know they aren’t alone and that people are working hard to fight back, says Sweeney.

“Everyone really wants to stop it, so pacing may be the only frustration,” he says. “Let’s do more. Hit them while they’re down so that more people don’t have that moment where they’re having to figure out how to report a scam.”