europolEuropol has successfully coordinated the latest phase of Operation Endgame, a major international cybercrime investigation targeting some of the world’s most significant malware and hacking infrastructures.

Between 10 and 14 November 2025, coordinated action was led from Europol’s headquarters in The Hague, resulting in the takedown of three major cybercrime enablers:

• Rhadamanthys, a prolific infostealer;

• VenomRAT, a powerful Remote Access Trojan; and

• Elysium, a large-scale botnet network.

Authorities also confirmed the arrest of the main VenomRAT suspect in Greece on 3 November 2025.

Massive Disruption to Cybercriminal Infrastructure

The dismantled systems were responsible for infecting hundreds of thousands of computers worldwide, stealing millions of user credentials and sensitive data.
Operation Endgame, coordinated jointly by Europol and Eurojust, brought together law enforcement and judicial authorities from Australia, Belgium, Canada, Denmark, France, Germany, Greece, Lithuania, the Netherlands, the United Kingdom, and the United States.

More than 30 national and international partners supported the effort, including leading cybersecurity organisations such as Cryptolaemus, Shadowserver, RoLR, Spycloud, Team Cymru, Proofpoint, CrowdStrike, Lumen, Abuse.ch, Have I Been Pwned, Spamhaus, DIVD, and Bitdefender.

Results at a Glance

• 1 arrest (Greece)

• 11 locations searched (1 in Germany, 1 in Greece, 9 in the Netherlands)

• Over 1,025 servers taken down or disrupted globally

• 20 domains seized

Millions in Stolen Data and Crypto Assets

The dismantled infrastructure contained hundreds of thousands of infected systems, many of which belonged to victims unaware of the compromise. Investigators discovered the primary infostealer suspect had access to over 100,000 cryptocurrency wallets, potentially worth millions of euros.

Victims are encouraged to check whether their devices have been affected via:
🔗 politie.nl/checkyourhack
🔗 haveibeenpwned.com

Engaging Criminal Users and Raising Awareness

As part of the coordinated action, law enforcement reached out directly to users of criminal services, urging them to share information about infostealers via the Operation Endgame Telegram channel.
Failing criminal services are also being publicly exposed through the Operation Endgame website, increasing transparency and deterrence.

Europol’s Central Command Post

During the operation, Europol facilitated intelligence exchange and provided forensic, analytical, and crypto-tracing support. A dedicated command post at Europol hosted more than 100 law enforcement officers from Australia, Canada, Denmark, France, Germany, Greece, and the United States, coordinating in real time the exchange of intelligence, seized data, and suspect information.

Eurojust played a vital role in supporting European Arrest Warrants and Investigation Orders, ensuring smooth judicial cooperation across borders.

Participating Authorities

EU Member States:

• Denmark: Danish Police (Politi)

• France: National Police (Police Nationale); Public Prosecutor Office JUNALCO; Paris Police Prefecture

• Germany: Federal Criminal Police Office (Bundeskriminalamt); Public Prosecutor General’s Office Frankfurt am Main – Cybercrime Office

• Greece: Hellenic Police (Ελληνική Αστυνομία)

• Lithuania: Lithuanian Criminal Police Bureau (Lietuvos Policijos Departamentas)

• Netherlands: National Police (Politie); Public Prosecution Office (Openbaar Ministerie)

Non-EU Member States:

• Australia: Australian Federal Police

• Canada: Royal Canadian Mounted Police; Sûreté du Québec

• United States: Federal Bureau of Investigation (FBI); Defense Criminal Investigative Service (DCIS); U.S. Department of Justice

Operation Endgame Continues

While this phase marks a significant success, Europol emphasises that Operation Endgame is ongoing.

“This is not the end — it’s a major step forward. The fight against cybercrime continues. We urge the public and private sector to stay alert and take proactive measures to protect their systems,” Europol stated.