Loading story…
An international law enforcement operation led by Europol and partner agencies seized control of the Emotet malware infrastructure, disrupting one of the world’s most dangerous botnets and cutting off a major delivery platform used to distribute additional malware. Investigators took over servers in multiple countries and redirected infected machines to law-enforcement-controlled infrastructure, undermining the criminal operation behind Emotet and preventing the botnet from continuing normal command-and-control activity.
After the takedown, authorities used that access to push a cleanup routine to infected devices, with reports indicating the uninstall action was scheduled for April 25, 2021 and ultimately reached about 1.6 million compromised systems. The removal mechanism was designed to delete Emotet from Windows hosts without installing unrelated software, marking an unusually direct post-seizure remediation effort aimed at reducing residual infections after the botnet’s infrastructure had been dismantled.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Authorities executed the planned remediation step by sending a cleanup module to infected machines, targeting about 1.6 million compromised devices worldwide. The patch was designed to remove Emotet from victim systems after the botnet takeover.
Using compromised-address data obtained after the Emotet server seizure, Spamhaus began contacting domain owners, organizations, and email providers in mid-April 2021 to reset passwords and secure affected accounts. The group later said more than 60% of the 1.3 million accounts in its dataset had been re-secured after two months.
Following the takedown, investigators announced plans to push a law-enforcement-controlled uninstall routine to infected systems. The cleanup action was set to automatically remove Emotet malware from compromised devices on April 25, 2021.
Authorities from multiple countries, coordinated through Europol and Eurojust, disrupted Emotet by taking control of its infrastructure and arresting alleged operators in Ukraine. Investigators said they had taken over the malware's command-and-control network as part of the global action.
According to Intel 471, the coordinated U.S. and European law enforcement action to seize Emotet infrastructure occurred on January 26, 2021. The operation preceded the public announcement the following day and included action against infrastructure tied to alleged operators in Ukraine.
After gaining access to Emotet's command-and-control servers, law enforcement quietly monitored the botnet's operations for several months to map its infrastructure and identify those behind it. This surveillance phase preceded the public takedown.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
9 references tracked. Mallory keeps watching after this page renders.
npu.gov.ua
Open sourceintel471.com
Open sourcetherecord.media
Open sourcecpomagazine.com
Open sourcekrebsonsecurity.com
Open sourceeuropol.europa.eu
Open sourceeuropol.europa.eu
Open sourcezdnet.com
Open sourcebka.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Emotet** grew from a banking trojan into one of the most widely used malware delivery platforms, spreading mainly through phishing emails, hijacked reply chains, malicious Word and Excel attachments, and links that launched multi-stage infection chains. Researchers and government agencies reported that the malware stole email content, contacts, browser and mail credentials, and even reused stolen attachments to make lures more convincing, while also moving laterally inside Windows networks and maintaining persistence through services, registry changes, and in-memory modules. Campaigns increasingly abused legitimate tools such as `mshta.exe`, `cmd.exe`, `PowerShell`, `rundll32.exe`, and even process hollowing of renamed `certutil.exe` to evade detection. The botnet became a critical **initial access** source for follow-on malware and ransomware, delivering payloads including **TrickBot, QakBot, Dridex, IcedID, Gootkit, Ryuk, Conti, ProLock,** and **BitPaymer**, prompting defenders to treat any Emotet infection as an urgent enterprise incident. An international law-enforcement operation in 2021 seized and sinkholed Emotet infrastructure and enabled victim notification and malware removal efforts, but the malware resurfaced later with updated tradecraft, including revised cryptography based on **ECDH/ECDSA**, newer Windows crypto APIs, stronger obfuscation, and renewed spam campaigns using malicious Excel files and macros. Security groups such as **Cryptolaemus**, national CERTs, and vendors continued publishing indicators and response guidance as organizations remained exposed to credential theft, secondary payloads, and ransomware deployment.
Aug 15, 2026
An international law enforcement operation dubbed **Operation Endgame** disrupted major malware delivery and botnet infrastructure tied to **IcedID, SmokeLoader, SystemBC, Pikabot, Trickbot**, and remnants of **Bumblebee**, in what Europol and participating agencies described as the largest action of its kind against botnets. Authorities said the networks had been used to spread malware through hundreds of millions of phishing emails and to enable follow-on ransomware attacks and financial fraud, with investigators identifying several million infected computers worldwide over the past year. The coordinated action, supported by **Europol** and **Eurojust**, took down more than **100 servers**, seized over **2,000 domains**, and disinfected more than **10,000** infected systems, while additional operations across multiple countries led to arrests, interrogations, searches, and server seizures. Investigators also identified a key suspect allegedly linked to **69 million euros** in cryptocurrency proceeds, and separate reporting and research highlighted scrutiny of a **SmokeLoader** actor targeted as part of the crackdown.
Jun 29, 2026
U.S. and European law enforcement agencies disrupted the **QakBot** botnet, seizing infrastructure tied to malware that had infected more than **700,000 computers** worldwide and enabled ransomware, financial fraud, and other criminal activity. Europol and U.S. authorities said the operation cut off command-and-control systems and removed malware from compromised hosts, while CISA published guidance on the botnet’s tactics, indicators, and the broader effort to identify and disrupt the infrastructure behind it. Officials said QakBot operators and affiliates had generated at least **EUR 54 million** in ransom payments over the years. The takedown also produced a large cache of stolen data that the FBI shared for victim notification, allowing affected individuals to check exposed information through **Have I Been Pwned**. Reporting after the operation said the action could serve as a model for future botnet disruptions, with investigators using legal authorities and international coordination to seize servers, redirect traffic, and weaken criminal ecosystems that support follow-on ransomware attacks.
Jul 12, 2026