Cyber Strike Cripples Malware Networks

Europol, in a significant international collaboration, has successfully disrupted several high-profile malware networks, including SocGholish, Amadey, and StealC, through Operation Endgame. This operation involved coordinated efforts across multiple countries and private partners, crippling the criminal infrastructure that supported ransomware and other malicious software.

On June 24, 2026, Europol announced that the two-week-long operation saw the seizure of over EUR 41 million in criminally obtained crypto assets and the recovery of approximately 27 million stolen login credentials. Authorities decommissioned 326 servers and took down 142 domains, significantly disrupting the malware distribution network. This operation, which involved law enforcement agencies from countries including Canada, Denmark, Germany, the Netherlands, the UK, and the USA, as well as tech giants like Microsoft, aimed to dismantle the “assembly lines” used by cybercriminals to perpetrate ransomware attacks, financial fraud, and assaults on critical infrastructure.

These malware networks operated on a “cybercrime-as-a-service” model, where SocGholish, used mainly as a dropper/loader through fake browser updates, allowed unauthorized access to systems. Amadey and StealC facilitated further malware deployment and data theft, respectively. This crackdown also targeted the remediation of 14,971 infected websites linked to SocGholish, attributed to the Russian cyber-criminal group Evil Corp.

Europol’s European Cybercrime Centre (EC3) provided crucial analytical and technical support, ensuring seamless real-time information sharing and synchronization of efforts across borders. The operation also emphasized preventive measures, urging WordPress users to enhance their security practices to avoid future infections. This landmark operation underlines a strategic shift in combating cybercrime by targeting the entire ecosystem that enables such attacks to proliferate globally.