End of the game for cybercrime infrastructure: 1025 servers taken down

According to Europol, between 10 and 14 November 2025 the latest phase of Operation Endgame was coordinated from The Hague, targeting Rhadamanthys infostealer, VenomRAT and the Elysium botnet, with actions that dismantled a major cybercrime infrastructure responsible for infecting hundreds of thousands of victims worldwide.

The coordinated actions led to 1 arrest in Greece, 11 locations searched (1 in Germany, 1 in Greece, and 9 in the Netherlands) and over 1 025 servers taken down or disrupted worldwide, along with 20 domains seized. The dismantled infrastructure consisted of hundreds of thousands of infected computers containing several million stolen credentials, with many victims unaware of their infections.

The operation involved cooperation among Australia, Belgium, Canada, Denmark, France, Germany, Greece, Lithuania, the Netherlands, the United Kingdom and the United States, and important contributions were made by private partners such as Cryptolaemus, Shadowserver and RoLR, Spycloud, Cymru, Proofpoint, Crowdstrike, Lumen, Abuse[.]ch, HaveIBeenPwned, Spamhaus, DIVD and Bitdefender. The main suspect behind the infostealer had access to over 100 000 crypto wallets belonging to victims and was arrested in Greece on 3 November 2025.