Operation ENDGAME strikes again: the ransomware kill chain broken at its source

Cybercriminals around the world have suffered a major disruption after law enforcement and judicial authorities, coordinated by Europol and Eurojust, dismantled key infrastructure behind the malware used to launch ransomware attacks. From May 19 to 22, authorities took down some 300 servers worldwide, neutralised 650 domains, and issued international arrest warrants against 20 targets, dealing a direct blow to the ransomware kill chain. 

In addition, EUR 3.5 million in cryptocurrency was seized during the action week, bringing the total amount seized during the Operation Endgame to more than EUR 21.2 million.

This latest phase of Operation ENDGAME follows on from the largest-ever international action against botnets in May 2024. It targeted new malware variants and successor groups that re-emerged after last year’s takedowns, reinforcing law enforcement’s capacity to adapt and strike back – even as cybercriminals retool and reorganise.

Read more at Europol