EU, US, and Canadian authorities dismantle global malware network, seize millions in crypto, and charge 20 suspects in Operation Endgame’s major cybercrime crackdown.
 |
| Joint Euro-American-Canadian operation cripples malware network, seizes crypto assets, and targets cybercriminals, marking a milestone in international cybercrime enforcement. Image: CH |
PARIS, France — May 23, 2025:
European, American, and Canadian law enforcement agencies have successfully dismantled a vast international malware network, marking a significant victory in the fight against cybercrime. In a coordinated action known as Operation Endgame, authorities shut down over 300 malicious servers globally, neutralized 650 harmful domains, and seized €3.5 million in cryptocurrency.
The European Union’s criminal justice cooperation agency, Eurojust, announced the operation on Thursday, emphasizing the close collaboration between German, French, Dutch, Danish, British, American, and Canadian agencies. This effort follows the unprecedented May 2024 crackdown—the largest ever targeting botnets—and forms part of a continuing international offensive against cyber threats.
More than 36 suspects were identified during the investigation, with 20 individuals formally charged and subjected to international arrest warrants. The operation primarily targeted “initial access malware,” which allows cybercriminals to covertly penetrate victims’ computer systems and deploy additional malicious software, including ransomware.
“The dismantling of this network underlines the necessity of cross-border cooperation in combating cybercrime,” a Eurojust spokesperson said. The operation also involves public appeals for several key suspects, with German authorities preparing to add 18 of them to the EU’s Most Wanted list by Friday.
Since its launch in 2024, Operation Endgame has resulted in the seizure of over €21 million in assets linked to cybercriminal activities. Authorities have announced ongoing efforts to continue disrupting these networks, with future updates to be shared on the operation’s dedicated website.
This milestone reflects the increasing global commitment to safeguarding digital infrastructure and punishing perpetrators of cyberattacks that threaten individuals, businesses, and governments worldwide.