Shylock malware exits stage left, pursued by UK cyber police

National Crime Agency leads campaign to knock out Shakespearian malware that infected at least 30,000 PCs

The Shylock malware takes its name from one of Shakespeare’s most famous characters. Photograph: UniversalImagesGroup/Getty Images

The UK’s National Crime Agency has led a global campaign to knock out the Shylock malware, which infected at least 30,000 Windows PCs across the world and stole funds from victims’ online banking accounts.

Command and control servers for Shylock, so named as its code contained quotes from Shakespeare’s Merchant of Venice, were located and seized by international law enforcement bodies, including the FBI, the German Federal Police and Europol.

UK intelligence agency GCHQ was also involved in investigating the cybercriminal operation.

The website domains used to control the malware were also shut down, as global cyber police gathered over 9 and 10 July in the operational centre at the European Cybercrime Centre (EC3) at Europol in The Hague.

“This phase of activity is intended to have a significant effect on the Shylock infrastructure and demonstrates how we are using partnerships across sectors and across national boundaries to cut cybercrime impacting the UK,” said Andy Archibald, deputy director of the NCA’s National Cyber Crime Unit.

“We continue to urge everybody to ensure their operating systems and security software are up to date.”

Most victims of Shylock were based in the UK, with upwards of 10,00 infections, an NCA spokesperson told the Guardian. Users in US, Italy and Turkey have also been hit by the malware, which was first discovered in the second half of 2011.

The criminals running the operation spread the malware by spreading links that led to downloads of the malware, either via spam email or in Skype instant messaging.

Once on a system, it would detect when a user was visiting a banking website, create fake login sections of that site and then pilfer banking logins. This information would be sent to the criminals, who would siphon off money from the accounts.

Shylock could also take screenshots or record videos of specific web pages, and upload stolen information and data about the infected computer and installed software.

It was ranked as one of the top banking malware types of 2013 by Dell SecureWorks, which assisted the police operation, alongside anti-virus provider Kaspersky.

Users who have automated updating for their Windows machines switched on need not do anything, as this will fix any problems for those infected with Shylock, the NCA said. Anyone concerned about the malware can head to Microsoft’s support page to learn more about disinfection.

The spokesperson said the NCA expects to see “a significant number of infected machines to be cleaned of Shylock following the operating system auto update”.