Operation ENDGAME Strikes Again: Ransomware Kill Chain Disrupted

Law enforcement agencies, led by Europol and Eurojust, have successfully disrupted cybercriminal operations worldwide by dismantling key infrastructure behind ransomware attacks. During a recent operation from 19 to 22 May, authorities seized 300 servers, neutralized 650 domains, and issued international arrest warrants against 20 targets. This action resulted in a direct blow to the ransomware kill chain, with EUR 3.5 million in cryptocurrency seized. The operation targeted initial access malware, which cybercriminals use to infiltrate systems before deploying ransomware, effectively damaging the entire cybercrime ecosystem. Various malware strains were neutralized during the operation, including Bumblebee, Lactrodectus, Qakbot, DanaBot, Trickbot, and Warmcookie.

Europol’s Executive Director, Catherine De Bolle, emphasized the importance of disrupting criminal services that enable ransomware attacks, breaking the kill chain at its source. Operation ENDGAME, an ongoing international effort against ransomware services, received support from Europol and Eurojust, facilitating coordination, cryptocurrency tracing, and real-time information exchange among partner agencies. The operation involved investigators from Canada, Denmark, France, Germany, the Netherlands, the United Kingdom, and the United States, working together to combat cybercrime.

Several key suspects involved in malware operations are now subject to international and public appeals, with German authorities set to publish 18 suspects on the EU Most Wanted list. As law enforcement agencies continue to adapt to combat cybercriminal innovation, the upcoming Europol Internet Organised Crime Threat Assessment (IOCTA) 2025 will focus on initial access brokers to address the early stages of cyberattacks. Operation ENDGAME will proceed with follow-up actions announced on the dedicated website of international law enforcement partners, showcasing ongoing efforts to combat ransomware and cybercrime globally.