Key Points
- Over 300 servers and 650 domains were taken down in a global malware crackdown.
- 20 individuals have been criminally charged, with international arrest warrants issued.
- Authorities from seven countries participated in the operation, including the U.S., UK, and Germany.
- €3.5 million in cryptocurrency was seized in this phase; over €21 million total since 2024.
In a major international cybercrime crackdown, authorities from Europe, the U.S., and Canada have dismantled more than 300 servers and issued international arrest warrants for 20 individuals linked to a sophisticated malware operation. The coordinated effort, named Operation Endgame, was revealed in a statement by Eurojust, the European Union Agency for Criminal Justice Cooperation.
The operation targeted some of the most dangerous malware variants on the internet, particularly those used for “initial access.” This form of malware stealthily infiltrates systems and paves the way for further attacks like ransomware. These types of malware are especially insidious as they often go undetected while establishing backdoor access to systems.
Authorities from Germany, France, the Netherlands, Denmark, the United Kingdom, the United States, and Canada collaborated. Together, they identified more than 36 suspects, formally charged 20 individuals, and neutralized 650 domains used to host or distribute malware. Law enforcement also seized €3.5 million in cryptocurrency, bringing the total seizure from the broader 2024 operation to over €21.2 million.
The latest actions build upon the May 2024 takedown of major botnets, which was previously the largest operation of its kind. Operation Endgame is part of an ongoing campaign, with follow-up actions expected in the coming months. Authorities have also launched public appeals to help capture key figures behind the malware networks.
This Friday, German authorities are expected to list eighteen top suspects on the EU’s Most Wanted list. A dedicated website for Operation Endgame is now live, providing updates and additional information on the crackdown.
This sweeping action represents a significant step in the global fight against cybercrime, as governments intensify efforts to curb the spread of ransomware and hacking infrastructure targeting businesses, institutions, and individuals worldwide.
