Danabot Malware Reemerges with Version 669 After Operation Endgame

Danabot banking malware has reappeared in a new guise with version 669, marking a return after a nearly six‑month hiatus since the Operation Endgame takedown in May 2025. The article notes that threat actors regrouped and rebuilt their command-and-control infrastructure to kick off a fresh campaign, despite international law enforcement efforts.

Security researchers have identified multiple newly deployed C2 servers, including traditional IP-based servers and Tor-hosted domains, to improve persistence and evade takedown attempts.

The resurfaced variant continues to target cryptocurrency assets, with dedicated wallet addresses identified for several cryptocurrencies, including Bitcoin (12eTGpL8EqYowAfw7DdqmeiZ87R922wt5L), Ethereum (0xb49a8bad358c0adb639f43c035b8c06777487dd7), Litecoin (LedxKBWF4MiM3x9F7zmCdaxnnu8A8SUohZ), and TRON (TY4iNhGut31cMbE3M6TU5CoCXvFJ5nP59i). This multi‑currency approach is designed to maximise monetisation from compromised systems regardless of victims’ holdings.

The write‑up emphasises that organisations should bolster endpoint detection and response, monitor the identified C2 infrastructure, and heighten security awareness to mitigate this evolving threat.