Europol, US, EU Dismantle 300 Servers, Seize €3.5M Cryptocurrency

In a coordinated international operation called Operation Endgame, law enforcement agencies from the EU, US, UK, Canada, and other countries dismantled over 300 servers and neutralized 650 domains linked to initial access malware used to facilitate ransomware attacks. The operation, conducted from May 19 to 22, 2025, targeted dangerous malware families such as Bumblebee, Lactrodectus, QakBot, DanaBot, TrickBot, and Warmcookie, which are often offered as services to cybercriminals. Authorities issued international arrest warrants against 20 suspects involved in providing or operating these malware services, with 37 individuals identified and some added to the EU's Most Wanted list. The agencies seized €3.5 million in cryptocurrency during this phase, bringing the total amount confiscated since the operation's start in 2024 to over €21.2 million. Europol’s Executive Director Catherine De Bolle emphasized that these efforts disrupt the ransomware kill chain by targeting criminals' access points and adapting to their evolving tactics. The U.S. Department of Justice also unsealed charges against a Russian cybercrime gang linked to the DanaBot malware, responsible for infecting over 300,000 computers and causing damages exceeding $50 million.