The NCA’s Central Role in Fighting Cybercrime & Ransomware

The Emerging Threat of Ransomware

Cybercrime has emerged as a Tier One national security threat, with ransomware identified as one of the most significant and pervasive dangers facing nations and organisations alike. The UK has seen a substantial rise in ransomware incidents, with recorded attacks increasing by 55% in 2023, and continuing into 2024. The majority of these attacks have targeted critical sectors, including healthcare and manufacturing, which have become prime targets due to their reliance on essential services​ (Cloudwards)​.

As this threat continues to evolve, cybercriminals are becoming increasingly sophisticated, constantly adapting their tactics to exploit vulnerabilities in digital infrastructures. The rise of ransomware has highlighted the urgent need for robust cybersecurity measures and coordinated global responses. Looking ahead, the integration of Artificial Intelligence (AI) into both offensive and defensive cyber operations could further transform the landscape, presenting new challenges and opportunities in the ongoing battle against cybercrime. This article explains the NCA’s Critical role in fighting cybercrime with a case study on the Genesis Market Takedown, mentioned in Paul’s interview above.

Ransomware Definition: Ransomware is a type of malicious software that encrypts a victim’s personal data, making it inaccessible unless a payment, or “ransom,” is made to regain access.

Related articles:

Rising Cybersecurity Threat to Schools: Advice from the NCSC

CrowdStrike: 6 Crisis Management Lessons for the Public Sector

Building Cyber Resilience for Northwest SMEs with the NWCRC

National Crime Agency Overview

The National Crime Agency (NCA) is a law enforcement agency in the United Kingdom responsible for tackling serious and organised crime. Established in 2013, the NCA operates as a national agency with a broad remit to combat various forms of crime that threaten the safety and security of the UK. Below is a summary of the NCA’s key functions, structure, and operations:

Key Functions:

1. Tackling Serious and Organised Crime: The NCA’s primary focus is on combating serious and organised crime, which includes activities such as human trafficking, drug smuggling, child sexual exploitation, cybercrime, fraud, and firearms trafficking.
2. Protecting the Public: The agency is tasked with protecting the public from the most serious criminal threats, both in the UK and internationally. This includes working to dismantle criminal networks, bringing offenders to justice, and preventing harm to individuals and communities.
3. Intelligence Gathering and Analysis: The NCA plays a crucial role in gathering and analysing intelligence related to criminal activities. This intelligence is used to guide operations and inform broader law enforcement efforts across the country.
4. International Collaboration: Recognising the global nature of many organised crime networks, the NCA collaborates closely with international law enforcement agencies. It works with bodies such as Europol, Interpol, and various national police forces to combat cross-border crime.
5. Leading and Coordinating: The NCA is responsible for leading and coordinating the national response to serious and organised crime. It works alongside regional police forces and other law enforcement agencies to ensure a cohesive and effective approach.

The NCA has been instrumental in disrupting organised crime networks, rescuing victims of exploitation, and recovering millions of pounds in criminal assets. Its role is critical in maintaining national security and ensuring the UK remains a hostile environment for organised crime.

Case Study: The Genesis Market Takedown

The Genesis Market Takedown was a significant operation led by the National Crime Agency (NCA) in collaboration with international law enforcement agencies. The operation targeted Genesis Market, a notorious online marketplace that specialised in the sale of stolen credentials, digital identities, and other illicit data used for cybercriminal activities.

Overview of Genesis Market:

• Genesis Market was a major underground marketplace, operational since around 2018. It provided cybercriminals with access to a vast array of stolen personal information, including login credentials, cookies, browser fingerprints, and other sensitive data. This data was often used for identity theft, fraud, and various types of cyber-attacks.
• The market was unique in that it offered a user-friendly interface and operated almost like a legitimate e-commerce site, allowing criminals to easily purchase and use stolen data. It even provided subscription services, where users could receive updates whenever the stolen credentials were changed or updated.

Operation Cookie Monster (2023)

• Operation Cookie Monster was the name given to the coordinated law enforcement action that led to the takedown of Genesis Market. This operation involved multiple agencies, including the NCA, the FBI, Europol, and others, reflecting the global nature of the marketplace and its impact on cybercrime worldwide.
• On April 4, 2023, Genesis Market was officially taken down in a coordinated effort that saw its infrastructure seized and shut down by law enforcement agencies.
• The operation led to the arrest of numerous individuals globally who were involved in the operation and use of the marketplace. These arrests included both the operators of Genesis Market and many of its users who were involved in various forms of cybercrime.

Impact and Outcome:

• Disruption of Cybercrime: The takedown of Genesis Market was a significant blow to cybercriminals who relied on the platform to carry out fraud, identity theft, and other illegal activities. It disrupted a key part of the cybercrime ecosystem, where criminals could easily acquire and trade in stolen digital identities.
• Seizure of Data: During the operation, law enforcement agencies seized large amounts of data, including millions of stolen credentials that had been listed for sale on the marketplace. This data seizure was crucial in preventing further misuse of stolen identities and helping potential victims recover from the impact of the breaches.
• Global Cooperation: The success of Operation Cookie Monster highlighted the importance of international cooperation in tackling cybercrime. The operation involved agencies from numerous countries, all working together to take down a global threat to digital security.
• Public Awareness: The takedown of Genesis Market also served to raise public awareness about the risks of cybercrime and the importance of protecting personal information online. It underscored the vulnerabilities that can be exploited through marketplaces that trade in stolen data.

NCA’s Role:

• The NCA played a crucial role in both the intelligence gathering and operational aspects of the takedown. The agency’s Cyber Crime Unit was heavily involved in the investigation, working alongside international partners to trace the activities of those involved in Genesis Market.
• The NCA also played a key role in the arrests and subsequent legal actions taken against individuals connected to the marketplace in the UK and abroad.

The Significance of the NCA to Cybersecurity

The Genesis Market takedown is considered one of the most significant law enforcement actions against cybercrime in recent years. By dismantling this major marketplace, the NCA and its partners struck a considerable blow against organised cybercrime, sending a clear message about the international community’s ability to collaborate effectively in the fight against digital threats.

In summary, the NCA is a vital component of the UK’s law enforcement landscape, dedicated to combating the most serious and complex criminal threats facing the country. Its multifaceted approach, combining intelligence, enforcement, and international cooperation, makes it a formidable agency in the fight against organised crime.

For more insights on the latest cybercrime threats and initiatives, join us at our latest Cyber Confex where we look to find robust solutions to fortify your digital defences against evolving threats.

Join us at The Public Sector Cyber Security Conference 2025 to receive the latest updates on the threat landscape. Discover the strategies and tactics required to successfully defend your organisation against attacks. Share experiences with your peers around the UK. Find the partners and solution providers you need to meet your challenges and stay secure.