Law enforcement agencies in Europe, North America and other regions have taken coordinated action against the infrastructure supporting several major cybercrime tools, in the latest phase of the long-running Operation Endgame. Europol reports that between November 10 and 13, 2025, authorities dismantled infrastructure used by the Rhadamanthys infostealer, the VenomRAT remote access trojan, and the Elysium botnet, taking down a reported 1,025 servers.
The Rhadamanthys campaign alone had compromised hundreds of thousands of systems worldwide and exfiltrated millions of credentials. Europol says the main suspect behind Rhadamanthys had access to over one hundred thousand cryptocurrency wallets, potentially worth millions of euros. In a related move, the main suspect alleged to be behind VenomRAT was arrested in Greece earlier in November.
Authorities are working with partners such as Have I Been Pwned and national police forces to notify victims and help them check whether their systems were part of the compromised infrastructure. For CISOs, the operation is a reminder of how widely reused crimeware platforms can be, and why identity and access security controls, including rapid credential rotation and strong authentication, remain critical even after law enforcement actions. Many organizations affected by these tools may not yet know that their credentials or session tokens were stolen and could still be circulating in criminal markets.
The takedown represents the latest success in the multi-year Operation Endgame initiative, which has targeted some of the world’s most prolific cybercrime infrastructure. However, security experts caution that while such operations provide temporary disruption, new malware-as-a-service platforms often emerge to fill the void, underscoring the need for continuous vigilance and adaptive authentication strategies.
Sources: Europol / Operation Endgame, Europol, Help Net Security
—
By the ID Tech Editorial Team
