Operation ENDGAME successfully dismantled major ransomware infrastructure by taking down 300 servers, 650 domains, and seizing €21.2 million in cryptocurrency.
Between May 19 and 22, 2025, Operation ENDGAME, coordinated by Europol and Eurojust, disrupted ransomware networks worldwide. Law enforcement agencies shut down 300 servers, took down 650 domains, and issued 20 international arrest warrants.
“A Command Post was established at Europol headquarters in The Hague during the operation week, with investigators from Canada, Denmark, France, Germany, the Netherlands, the United Kingdom, and the United States working alongside Europol’s European Cybercrime Centre and its Joint Cybercrime Action Taskforce,” the Europol press release stated. “Eurojust has played a crucial role in facilitating judicial cooperation since the investigation began in 2024. Their coordination allowed authorities to share information effectively and align investigative efforts.”
Authorities seized an additional €3.5 million in cryptocurrency, bringing the total amount recovered to over €21.2 million. This follows a botnet crackdown in 2024 aimed at combating evolving malware threats and cybercriminal groups.
The operation focused on initial access malware used by threat actors to breach systems before deploying ransomware. Neutralized malware strains included Bumblebee, Lactrodectus, Qakbot, Hijackloader, DanaBot, Trickbot, and Warmcookie, all frequently used in ransomware-as-a-service schemes. Authorities also issued 20 international arrest warrants for key operators behind these activities.
Several suspects involved in malware operations are now subject to international and public alerts. Starting May 23, Germany will add 18 of these individuals to the EU Most Wanted list. They are accused of providing or operating tools used in major ransomware attacks.
“This new phase shows law enforcement’s ability to adapt and respond even as cybercriminals change tactics and reorganize. By disrupting the services criminals rely on to launch ransomware, we are breaking the kill chain at its source,” said Catherine De Bolle, Europol Executive Director.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
