Europol says police in Germany, the UK, the US, and others took down botnets spreading ransomware via infected emails, arrested four, and seized 2,000+ domains
International law enforcement and partners have joined forces. Europol : Largest ever operation against botnets hits dropper malware ecosystem Bill Toulas / BleepingComputer : Police seize over 100 malware loader servers, arrest four cybercriminals Jacob Lyon / Protos : Europol uncovers malware plot that made $75M in crypto Federal Bureau of Investigation : Operation Endgame: Coordinated Worldwide Law Enforcement Action Against Network of Cybercriminals National Crime Agency : National Crime Agency part of international operation to destroy cyber crime services Proofpoint : Major Botnets Disrupted via Global Law Enforcement Takedown Eurojust : Major operation to take down dangerous malware systems Lucian Constantin / CSO : ‘Operation Endgame’ deals major blow to malware distribution botnets Becky Bracken / Dark Reading : Cops Swarm Global Cybercrime Botnet Infrastructure in 2 Massive Ops Dan Goodin / Ars Technica : Law enforcement operation takes aim at an often-overlooked cybercrime linchpin Rachel More / Reuters : Four arrested in sprawling European sting on malware network Mastodon: @abuse_ch@ioc.exchange : We are proud to announce that we assisted the joint international law enforcement operation #OperationEndgame, targeting the notorious botnets #IcedID, #Smokeloader, #SystemBC and #Pikabot 🔥 — abuse.ch has provided key infrastructure to LEA and internal partners to disrupt these botnet operations 🛑 … @haveibeenpwned@infosec.exchange : New breach: Operation Endgame involved a coalition of international law enforcement agencies dismantling a series of botnets. Impacted email addresses & passwords were provided to HIBP to help victims learn of exposure. 72% were already in @haveibeenpwned https://www.troyhunt.com/... X: @vxunderground : We are aware that one of the images released by the National Police of Ukraine, during a raid from Operation Endgame, shows an arrest of a naked person. No information is given on who this person is or why they're naked. tl;dr prolly raided while showering or going potty [image] @fbi : The #FBI and partners disrupted IcedID, a malware dropper which accessed victim computers to distribute malware and transmit personal and financial data. Our actions against IcedID demonstrate our tireless fight against Malware-as-a-Service. Read more at https://www.fbi.gov/... [image] @jplecouffe : Again a major operation against cybercrime ecosystem !! Operation ENDGAME is ongoing !! Look at our press release @Europol Largest ever operation against botnets hits dropper malware ecosystem | Europol https://www.europol.europa.eu/ ... @eurojust : 💻 An unprecedented major scale operation took place to take down malware systems, supported by Eurojust and @Europol. During actions in 🇩🇪, 🇳🇱, 🇫🇷, 🇩🇰, 🇺🇦, 🇺🇸 and 🇬🇧, 4 suspects were arrested and over 100 servers were taken down. 🔗Find out more: https://www.eurojust.europa.eu/ ... [image] Jeremy Kirk / @jeremy_kirk : This is a really important facet of this huge cybercriminal infrastructure takedown. @troyhunt writes 16.5M email addresses and 13.5M unique passwords that were stolen by malware apps such as IceID, Smokeloader and Bumblebee have now been loaded into @haveibeenpwned. 👇👇👇 Eric Geller / @ericgeller : Another big law-enforcement strike against botnets announced this morning, with the largest-ever takedown of cybercriminal infrastructure and 4 arrests in Armenia and Ukraine. https://www.europol.europa.eu/ ... [image] @vxunderground : Law enforcement agencies across the globe have come together, similar to Goku and Vegeta doing the Gogeta fusion dance, to form “Operation Endgame”. Agencies from The Netherlands, Denmark, United Kingdom, France, Germany, and the United States have created a website and disclose [video] @haveibeenpwned : New breach: Operation Endgame involved a coalition of international law enforcement agencies dismantling a series of botnets. Impacted email addresses & passwords were provided to HIBP to help victims learn of exposure. 72% were already in @haveibeenpwned https://www.troyhunt.com/... Troy Hunt / @troyhunt : This is a major achievement by our friends in international law enforcement agencies, and I'm very glad that @haveibeenpwned is playing a small part in helping the victims https://www.troyhunt.com/... @nca_uk : The National Crime Agency has dismantled the servers of prominent malware ‘droppers’ which have enabled cyber criminals to conduct ransomware attacks around the world. FULL STORY ➡️ https://www.nationalcrimeagency.gov.uk/ ... #OperationEndgame [image] @vxunderground : The latest release from Operation Endgame has been released. In this video it is evident that Law enforcement agencies across the globe banded together to pay for roughly 30 seconds of Skrillex sound bites [video] @threatinsight : Today we celebrate a major cybersecurity victory. https://www.proofpoint.com/... #OperationEndgame, a global law enforcement effort supported by insights from @threatinsight experts at @Proofpoint and other industry vendors, resulted in... 🧵⤵️ @europol : 🚨Largest ever operation against botnets hits dropper malware ecosystem. Operation Endgame, coordinated from Europol headquarters, has led to four arrests and the takedown of over 100 servers worldwide. More information in our press release⤵️ https://www.europol.europa.eu/ ... Jeremy Kirk / @jeremy_kirk : Huge cybercrime news here. Authorities say they've disrupted six types of botnets/loaders/cybercrime infrastructure: IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot https://www.europol.europa.eu/ ... Mehmet Ergene / @cyb3rmonk : This is huge! International operation shut down droppers including IcedID, SystemBC, Pikabot, Smokeloader and Bumblebee leading to four arrests and takedown of over 100 servers worldwide. #ThreatIntelligence #ThreatIntel https://www.europol.europa.eu/ ... @spamhaus : 🚨#IcedID, #Smokeloader, #SystemBC, #Pikabot and #Bumblebee botnets have been disrupted by Operation Endgame!! This is the largest operation EVER against botnets involved with ransomware, with gargantuan thanks to a coordinated effort led by international agencies👏👏 As with @bitdefender : Bitdefender partners with Europol and global allies to dismantle major malware infrastructures like IcedID and SystemBC. We are proud to support the largest-ever botnet takedown, advancing the fight against cybercrime. https://www.europol.europa.eu/ ... @ec3europol : 🚨Largest ever operation against #botnets hits #dropper malware ecosystem. The result? 4 arrests and over 100 servers taken down worldwide! Europol's EC3 facilitated the information exchange and provided analytical, crypto-tracing and forensic support. https://twitter.com/... Alan Woodward / @profwoodward : Botnets suffer serious blow as law enforcement agencies collaborate internationally to take down 100+ servers https://www.europol.europa.eu/ ... Alexander Leslie / @aejleslie : 👀 🚨 “Operation Endgame...targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot.” Massive. Anxiously awaiting further details, but this initial news will reverberate throughout the cybercriminal underground. Unbelievable effort here. Rob Joyce / @rgb_lights : Kudos to everyone involved in Operation Engame. It's a serious pushback against criminal capabilities that cause massive harm. Yes, there will be reconstitution in the future, but you can never stop challenging the bad actors in this space. LinkedIn: Devon Ackerman : “The coordinated actions led to: — 4 arrests (1 in Armenia and 3 in Ukraine) — 16 location searches (1 in Armenia, 1 in the Netherlands, 3 in Portugal and 11 in Ukraine) … Forums: r/Buttcoin : Massive international police operation takes down ransomware networks, arrests 4 (yes, crypto is at the heart of it) r/news : Massive international police operation takes down ransomware networks, arrests 4
Context & Ripple Effects
Operation Endgame extends a law-enforcement strategy of targeting the infrastructure that ransomware operators rely on before an extortion event occurs. It follows the FBI-led Qakbot disruption, which removed a long-used infection channel for ransomware groups.
The operation also arrived alongside the 911 S5 proxy-botnet dismantling, underscoring a coordinated focus on shared cybercrime services rather than solely on individual ransomware brands. Vendor and research-group intelligence was part of the Endgame effort.
First-order effects
- The named malware-loader and botnet operators lose servers and more than 2,000 domains used to deliver malicious payloads; four suspects face immediate law-enforcement action.
- Ransomware affiliates and other customers of these malware-as-a-service tools must replace disrupted delivery infrastructure, while affected users can be notified through breach data provided to Have I Been Pwned.
Second-order effects
- Security teams gain a window in which known loader infrastructure is less available, but criminal operators are incentivized to migrate to replacement domains, servers, or competing access services.
- The operation raises the value of coordination between investigators and threat-intelligence vendors: technical visibility becomes operational input for cross-border seizures rather than only defensive detection.
Third-order effects
- If repeated, infrastructure-led takedowns can make cybercrime services less dependable and more costly to operate, shifting enforcement from pursuing each ransomware campaign to disrupting the suppliers that enable many of them.
- The pattern points toward a more durable public-private enforcement model, though its lasting effect depends on whether replacements can be deployed faster than multinational authorities can identify and seize them.
The trend: Cybercrime enforcement is increasingly targeting the shared loader, botnet, and proxy infrastructure that supplies multiple criminal groups at once.