Loading story…
International law enforcement and industry partners expanded Operation Endgame to dismantle malware infrastructure tied to infostealers, botnets, remote access trojans, and ransomware enablement. Europol said a 2025 follow-up used a database seized in the 2024 takedown to identify customers of the Smokeloader pay-per-install botnet, resulting in five detentions and interrogations, house searches, arrest warrants, and so-called knock-and-talk actions across Europe and North America. Investigators said access bought through Smokeloader was used for keylogging, webcam access, cryptomining, and ransomware deployment, signaling that authorities are now pursuing not only operators but also downstream criminal users.
Dutch police later reported another coordinated Endgame action that included the arrest in Greece of a main suspect linked to VenomRAT, 11 searches, the takedown of 1,025 servers, and the seizure of 20 domains. Authorities said the disrupted malware families had infected more than 600,000 victims worldwide and enabled the theft of tens of millions of records; stolen user data was secured and made inaccessible, with victims directed to a police portal to check exposed credentials. Separate technical reporting on DanaBot described the malware-as-a-service platform as a stealthy, multi-tier operation with roughly 150 active C2 servers per day across more than 40 countries, and said its disruption under Operation Endgame II was the most significant blow to the botnet to date.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Europol announced that follow-up actions tied to Operation Endgame had led to five detentions and interrogations, using leads from the previously seized Smokeloader database to link online personas to real individuals.
In 2025, Operation Endgame II dealt what Team Cymru described as the most significant disruption to DanaBot to date through coordinated action by law enforcement, industry partners, and hosting providers.
In early 2025, law enforcement agencies in North America and Europe carried out follow-up actions against customers of the Smokeloader pay-per-install botnet, including arrests, house searches, arrest warrants, and knock-and-talks.
DanaBot activity hit all-time highs during the December 2024 holiday period, according to Team Cymru’s infrastructure analysis.
Researchers observed DanaBot activity increase by nearly 50 command-and-control servers before the November 2024 U.S. election.
Team Cymru reported that DanaBot’s upstream and backend infrastructure had remained largely unchanged since June 2024, indicating operational continuity ahead of later disruption efforts.
During Operation Endgame in May 2024, authorities targeted major malware droppers including IcedID, SystemBC, Pikabot, Smokeloader, and Bumblebee. A database seized in that action later helped investigators identify Smokeloader customers.
DanaBot was first reported in 2018 as a banking trojan before later evolving into an infostealer and malware delivery platform.
Dutch police said they secured stolen user data, including email addresses and login credentials, made it inaccessible, and directed the public to a police website to check whether their credentials were included.
As part of the Operation Endgame actions, authorities arrested a main suspect linked to VenomRAT in Greece.
Authorities from ten countries conducted coordinated Operation Endgame actions that included 11 searches, the takedown of 1,025 servers worldwide, and the seizure of 20 domains targeting infostealers, botnets, RATs, and related criminal services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
politie.nl
Open sourceoperation-endgame.com
Open sourceteam-cymru.com
Open sourceeuropol.europa.eu
Open sourceesentire.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An international law enforcement operation dubbed **Operation Endgame** disrupted major malware delivery and botnet infrastructure tied to **IcedID, SmokeLoader, SystemBC, Pikabot, Trickbot**, and remnants of **Bumblebee**, in what Europol and participating agencies described as the largest action of its kind against botnets. Authorities said the networks had been used to spread malware through hundreds of millions of phishing emails and to enable follow-on ransomware attacks and financial fraud, with investigators identifying several million infected computers worldwide over the past year. The coordinated action, supported by **Europol** and **Eurojust**, took down more than **100 servers**, seized over **2,000 domains**, and disinfected more than **10,000** infected systems, while additional operations across multiple countries led to arrests, interrogations, searches, and server seizures. Investigators also identified a key suspect allegedly linked to **69 million euros** in cryptocurrency proceeds, and separate reporting and research highlighted scrutiny of a **SmokeLoader** actor targeted as part of the crackdown.
Jun 29, 2026
International law enforcement agencies, coordinated by Europol and Eurojust, executed a major crackdown on the infrastructures supporting the Rhadamanthys infostealer, VenomRAT remote access trojan, and the Elysium botnet. The operation, part of the ongoing Operation Endgame, resulted in the takedown of over 1,025 servers and the seizure of 20 domains used to control and distribute these malware families. Authorities also arrested the main suspect behind VenomRAT in Greece, and the dismantled infrastructure included hundreds of thousands of infected computers and millions of stolen credentials, with many victims unaware of the compromise. The operation involved law enforcement from at least nine countries and was supported by numerous private sector partners, including cybersecurity firms and threat intelligence organizations. Rhadamanthys, a modular information stealer sold as malware-as-a-service, and VenomRAT, a commodity RAT favored by threat actors like TA558, were both widely distributed through email campaigns, malvertising, and other vectors. The Elysium botnet, less well-documented, was also linked to these operations, potentially serving as a proxy network for criminal activity. The disruption has caused significant operational issues for cybercriminals, with many reporting loss of access to their command-and-control panels and servers. Authorities have advised potential victims to check if their systems were compromised and to take remediation steps, as the takedown is expected to have a substantial impact on the cybercrime ecosystem.
Jul 12, 2026
U.S. and European authorities, working with security companies and researchers, disrupted the **GameOver Zeus** peer-to-peer botnet and seized infrastructure tied to **CryptoLocker** in a multinational action known as **Operation Tovar**. The malware network was estimated to have infected **500,000 to 1 million Windows systems** worldwide and was used to steal banking credentials, personal data, and funds through account takeovers, spam campaigns, and DDoS-assisted fraud. U.S. prosecutors said the operation caused more than **$100 million** in losses, while CryptoLocker had infected more than **234,000 computers** and generated over **$27 million** in ransom payments shortly after its emergence. The U.S. Justice Department charged Russian national **Evgeniy Mikhailovich Bogachev**, also known as `Slavik` and `Pollingsoon`, as the alleged administrator behind the botnet. Authorities said the takedown created a roughly **two-week window** for victims and enterprises to clean infected machines before operators could attempt to regain control, and agencies including **US-CERT** and internet service providers were mobilized to support remediation. Investigators said GameOver Zeus spread largely through phishing emails, malicious spam, and compromised websites exploiting outdated software, prompting officials to urge users to update systems, run security scans, and change passwords.
Aug 14, 2026