Coordinated action to take down the most dangerous malware variants

Authorities around the world cooperated this week to disrupt some of the world’s most dangerous malware. During an action week that took place between 19 May and 22 May, measures were taken against several malware families, and some of the perpetrators behind them were identified. In total, international arrest warrants were obtained against 20 individuals criminally charged, more than 300 servers were taken down and over EUR 3 million in cryptocurrency was seized. Eurojust and Europol have supported the authorities’ operation against the dangerous malware since 2024. This week’s actions follow the largest ever operation against botnets from May 2024, Operation Endgame. This year during Endgame 2.0, the measures targeted the successor groups of malware taken down by the authorities and other relevant variants: Bumblebee, Lactrodectus, Qakbot, Dana Bot, Hijack Loader, Trickbot, and Warm Cookie. As these variants are at the beginning of the cyberattack chain, disrupting them damages the entire ‘cybercrime as a service’ ecosystem. The malware taken down this week is known as ‘initial access malware’. It is used for initial infection, helping cybercriminals to enter victims’ systems unnoticed and load more malware onto their devices, such as ransomware. Due to the global nature of cybercrime, cross-border investigations are key for taking action against disruptive cybercrimes. Since 2024, Eurojust has provided essential support to ensure effective judicial cooperation....