Operation Endgame: Authorities Takedown 1,025 Servers Linked to Rhadamanthys, VenomRAT, and Elysium

Between 10 and 14 November 2025, law enforcement agencies carried out a coordinated operation from Europol’s headquarters in The Hague that dismantled three major cybercrime threats: Rhadamanthys infostealer, VenomRAT, and the Elysium botnet.

According to Europol, the operation brought together authorities from eleven countries, including the United States, Canada, Australia, and multiple European nations, with over 100 officers staffing a command centre and more than 30 public and private organisations providing support. Authorities dismantled over 1,025 servers worldwide, seized 20 domains, and arrested a primary suspect behind VenomRAT operations in Greece on 3 November.

The targeted infrastructure is said to have infected hundreds of thousands of victims globally, with Rhadamanthys described as one of the most dangerous infostealers on the dark web and the main suspect reportedly having access to over 100,000 cryptocurrency wallets. The operation also involved millions of stolen credentials and highlighted significant private‑sector cooperation from CrowdStrike, Proofpoint, Bitdefender, and Have I Been Pwned.

Victims could verify compromise via checkyourhack.politie[.]nl and haveibeenpwned[.]com as part of the response, while Eurojust and other agencies streamlined legal processes.