Law enforcement has deployed an internationally coordinated operation to simultaneously dismantle large-scale cybercriminal infrastructure. Europol announced that the latest phase of "Operation Endgame" was conducted from its The Hague headquarters November 10-13, simultaneously neutralizing three major infrastructures used for international crime: infostealer "Rhadamanthys," remote-control malware "VenomRAT," and global botnet "Elysium."
The core suspect for VenomRAT was arrested in Greece on November 3, with search and seizure operations in 11 locations including Germany, Greece, and the Netherlands during the operation period. Globally, over 1,025 servers were shut down or disrupted and 20 domains used for crime were seized. Europol stated the dismantled infrastructure "consisted of hundreds of thousands of infected computers containing millions of stolen account credentials." Many victims were unaware they had been infected. Rhadamanthys operators had access to over 100,000 cryptocurrency wallets belonging to victims, with authorities explaining assets in these wallets could be worth millions of euros.
The operation was coordinated by Europol and Eurojust with simultaneous participation from judicial/investigative agencies in 11 countries including Australia, Belgium, Canada, Denmark, France, Germany, Greece, Lithuania, the Netherlands, the UK, and the US. Europol noted over 30 public and private partners supported the operation including Cryptolaemus, Shadowserver, Proofpoint, Crowdstrike, Lumen, Abuse.ch, and HaveIBeenPwned. A command center at Europol's The Hague headquarters had over 100 investigators from 8 countries conducting real-time information sharing and forensic analysis.
Authorities also took action against criminals using these tools — directly contacting some users requesting related information submission via Telegram channel, and publicly exposing criminal services through the operation website. Europol emphasized "this operation is not an end but the beginning of the next phase." Victims are urged to check infection status at politie.nl/checkyourhack or haveibeenpwned.com.
