Operation Endgame Disrupts 1,025 Servers Linked to Rhadamanthys, VenomRAT and Elysium

International authorities disrupted infrastructure supporting the Rhadamanthys infostealer, VenomRAT remote-access trojan and Elysium botnet in the latest phase of Operation Endgame. Coordinated by Europol and Eurojust, the November 2025 actions took down or disrupted more than 1,025 servers worldwide, seized 20 domains and searched 11 locations across Germany, Greece and the Netherlands. The main VenomRAT suspect was arrested in Greece on November 3. The targeted infrastructure had infected hundreds of thousands of computers worldwide and was associated with several million stolen credentials; Europol said the main infostealer suspect had access to more than 100,000 victims’ cryptocurrency wallets.

France’s ANSSI is supporting victim identification and notification and warned that these malware families can provide entry points for data theft, additional malicious tools and ransomware. VenomRAT, sold as malware-as-a-service, provides persistent remote access and can download additional payloads, with distribution including phishing and fraudulent websites impersonating legitimate software providers. Organizations identifying an infection should investigate beyond the affected endpoint, looking for lateral movement and additional malware rather than assuming the infrastructure disruption eliminated the compromise. Europol also directed potential victims to the Dutch police’s Check Your Hack service and Have I Been Pwned to check for exposure.