Operation ENDGAME cracks down on ransomware

An international crackdown on cybercriminals launching malware attacks, including ransomware, has resulted in a mass takedown of servers and websites and 20 arrest warrants.

The latest phase of Operation ENDGAME – extending what was described last year as the largest-ever international action against botnets – targeted new malware variants and successor groups that re-emerged after takedowns trumpeted in 2024.

In addition, €3.5m (nearly $4m) in cryptocurrency was seized during the action week, which was coordinated by Europol and Eurojust and focused on initial access malware – used by cybercriminals to infiltrate systems unnoticed before deploying ransomware – including tools called Bumblebee, Lactrodectus, Qakbot, DanaBot, Trickbot, and Warmcookie.

"By disabling these entry points, investigators have struck at the very start of the cyberattack chain, damaging the entire cybercrime-as-a-service ecosystem," said Europol in a statement on the enforcement action.

The tools that were neutralised are generally offered as a service to other cybercriminals and are used to pave the way for large-scale ransomware attacks.

"This new phase demonstrates law enforcement’s ability to adapt and strike again, even as cybercriminals retool and reorganise," said Catherine De Bolle, Europol's executive director.

"By disrupting the services criminals rely on to deploy ransomware, we are breaking the kill chain at its source."

RapTor targets dark web criminals

Meanwhile, another enforcement action coordinated by Europol – Operation RapTor – has dismantled networks on the dark web trafficking in drugs, weapons, and counterfeit goods, with 270 arrests of vendors and buyers.

The suspects were identified through coordinated investigations based on intelligence from the takedowns of the dark web marketplaces Nemesis, Tor2Door, Bohemia and Kingdom Markets. Many had conducted thousands of sales on illicit marketplaces, using encryption tools and cryptocurrencies to cover their tracks, but law enforcement was nevertheless able to penetrate the networks.

During the operation, more than €184m in cash and cryptocurrencies, along with two tonnes of illicit drugs, hundreds of firearms, 12,500 counterfeit products, and four tonnes of illegal tobacco.