Operation ENDGAME strikes again: the ransomware kill chain broken at its source

In addition, EUR 3.5 million in cryptocurrency was seized during the action week. This latest phase of Operation ENDGAME follows on from the largest-ever international action against botnets in May 2024. It targeted new malware variants and successor groups that re-emerged after last year’s takedowns, reinforcing law enforcement’s capacity to adapt and strike back – even as cybercriminals retool and reorganise. The operation focused on initial access malware – the tools cybercriminals use to infiltrate systems unnoticed before deploying ransomware. By disabling these entry points, investigators have struck at the very start of the cyberattack chain, damaging the entire cybercrime-as-a-service ecosystem. The following malware strains were neutralised during the action: Bumblebee Lactrodectus Qakbot DanaBot Trickbot Warmcookie These variants are commonly offered as a service to other cybercriminals and are used to pave the way for large-scale ransomware attacks. In addition, international arrest warrants were issued against 20 key actors believed to be providing or operating initial access services to ransomware operators. Catherine De Bolle Europol Executive Director "This new phase demonstrates law enforcement’s ability to adapt and strike again, even as cybercriminals retool and reorganise. By disrupting the services criminals rely on to deploy ransomware, we are breaking the kill chain at its source." Operation Endgame is an ongoing, long-term oriented, large-scale...