The latest phase of Operation Endgame – an international law-enforcement initiative targeting the global cybercrime infrastructure that enables ransomware, credential theft and large-scale malware attacks – has led to the dismantling of more than 1,025 servers linked to three major criminal platforms.

Coordinated between 10 and 13 November from Europol’s headquarters in The Hague, phase 3 of the operation focused on the infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the Elysium botnet.

These services have been widely used by cybercriminals to compromise systems, steal data and facilitate remote access attacks across hundreds of thousands of victims worldwide.

Authorities confirmed that the main suspect behind VenomRAT was arrested in Greece on 3 November. The operation, coordinated by Europol and Eurojust, involved law-enforcement and judicial agencies from Europe and beyond.

Investigators said the dismantled infrastructure contained “hundreds of thousands of infected computers” and “several million stolen credentials.” Many victims had no idea their systems were compromised.

Europol noted that the main suspect behind the Rhadamanthys infostealer had access to more than 100,000 crypto wallets belonging to victims, potentially worth millions of euros.

In total, the coordinated activity resulted in one arrest, 11 searches across Germany, Greece and the Netherlands, over 1,025 servers taken down or disrupted, and 20 domains seized.

Authorities urged the public to check whether their devices were affected, directing users to politie.nl/checkyourhack and haveibeenpwned.com for guidance.

Police also contacted users of the now-disrupted criminal services directly and encouraged them to submit information through the Operation Endgame Telegram channel. Additional details exposing the failing criminal services have been published on the Operation Endgame website.

Recommended reading

• 60% of UK IT Leaders Urge for Data Sovereignty In Wake of US Tariffs
• Tariffs and Trade War Are the Top Emerging Risks of Q2 2025
• Report: Cybersecurity Tops Tariffs as Q1 Priority for Supply Chains

Europol said the action is part of a sustained effort to weaken the criminal infrastructure driving international cybercrime, adding – and yes, this is quote they went with: “Endgame doesn’t end here – think about (y)our next move.”

Join the Conversation

Don’t miss DIGIT Expo 2025 on 27 November at the EICC Edinburgh – Scotland’s largest tech showcase featuring 5 stages of keynotes, 60+ exhibitors and networking with 1,700+ IT & digital professionals.

Secure your free ticket now: Register here