International Authorities Take Down Malware Network

A joint anti-malware operation by EU, US, and Canadian authorities took down over 300 servers, issued 20 international arrest warrants, and seized over €3.5 million in cryptocurrency. The coordinated effort happened between May 19 and May 22, according to the European Union Agency for Criminal Justice Cooperation (Eurojust).

Eurojust led the seven-country operation in conjunction with the European Union Agency for Law Enforcement Cooperation (Europol).

The action follows a May 2024 operation dubbed “Operation Endgame,” which Eurojust claims was the “largest ever operation against botnets.” Botnets are networks of compromised devices infected by malware and centrally controlled by a malicious actor. Operation Endgame included actions such as taking down botnets, arresting cybercrime suspects, and freezing illegal proceeds.

The operation disrupted “initial access malware,” which gives malicious actors access to a computer or device so they can later install various types of malware, such as infostealers, spyware, and ransomware, into the victim’s device. This initial access malware usually starts as infected Word or PDF files sent to various users through email attachments.

Malware targeted by Operation Endgame (also referred to as “droppers”) included popular programs such as IcedID, Pikabot, Smokeloader, Bumblebee, and Trickbot. The operation that took place in early May, called Endgame 2.0, targeted the successor programs to the ones disrupted in 2024.

The total amount of the seized funds since 2024 is over €21.2 million. Eighteen suspects identified by German authorities are expected to appear on the EU’s most wanted list by May 30.

“As these variants are at the beginning of the cyberattack chain, disrupting them damages the entire ‘cybercrime as a service’ ecosystem,” writes Eurojust in its May 23 press release.

“This new phase demonstrates law enforcement’s ability to adapt and strike again, even as cybercriminals retool and reorganise. By disrupting the services criminals rely on to deploy ransomware, we are breaking the kill chain at its source,” said Catherine De Bolle, Europol’s Executive Director.

Operation Endgame will continue its efforts for the foreseeable future, publishing progress updates on its dedicated website.

Targeting initial access malware represents a crucial step in preventing data leaks, spyware attacks, and more in a time when cybercrime is ramping up. In late May, a suspected infostealer data breach exposed over 182 million logins and passwords.