Top 10 Cybercrime Law Enforcement Operations of 2025

The Top 10 Cybercrime Law Enforcement Operations of 2025 detail a year of coordinated takedowns across ransomware, fraud networks and malware services, with dates spanning January to December.

Among the highlights, Operation Talent (28–30 January 2025) shut down Cracked and Nulled forums, arresting an administrator in Spain and seizing servers and domains; Operation Phobos Aetor (10 February 2025) targeted the Phobos/8Base ransomware network, with arrests in Thailand and charges in the US; and Zservers / LockBit Sanctions (11 February 2025) saw coordinated sanctions against the Russia-based hosting provider Zservers.

The chronology continues with LummaC2 Takedown (21 May 2025), Eastwood (14–17 July 2025) targeting NoName057(16) and DDoS operations, and Checkmate – BlackSuit Ransomware (24 July 2025) which dismantled core sites and seized cryptocurrency linked to ransom payments. Operation Serengeti 2.0 (July–August 2025) is described as coordinated by Interpol with support from the UK NCA, arresting more than a thousand suspects and recovering tens of millions of dollars.

The list also notes the Prince Group Bitcoin Seizure (14 October 2025) with about 127,000 Bitcoin valued at roughly $15 billion seized, Endgame 3.0 (10–13 November 2025) across multiple countries, and Red Circus (9 December 2025) indicting CyberArmyofRussia_Reborn and NoName057(16). These cases illustrate the widening reach of law enforcement actions against state-linked hacktivists, ransomware operators, and fraud networks.

According to Interpol, the Serengeti 2.0 operation coordinated a widespread sweep across 18 African countries, arresting many suspects and taking down thousands of websites and servers.