Europol Pulls the Plug on Three Malware Services in Operation Endgame's Latest Round
Police took down or disrupted more than 1,025 servers behind the Rhadamanthys infostealer, the VenomRAT trojan and the Elysium proxy botnet.
Key takeaways
- More than 1,025 servers and 20 domains were taken down or disrupted between 10 and 14 November 2025.
- The main VenomRAT suspect was arrested in Greece on 3 November; he reportedly had access to over 100,000 crypto wallets.
- Rhadamanthys' operator told customers to stop using the tool just before its infrastructure went dark.
Europol and its partners have hit three of the criminal ecosystem's workhorse tools in one sweep. Between 10 and 14 November 2025, authorities took down or disrupted more than 1,025 servers tied to the Rhadamanthys infostealer, the VenomRAT remote access trojan and the Elysium proxy botnet, and seized 20 domains.
What happened
The action is the latest phase of Operation Endgame, a multi-year effort involving law enforcement in several European countries plus Australia, Canada, the UK and the US. This round was coordinated from Europol's headquarters in The Hague. Its headline result was infrastructure, not arrests: command servers, panels and licensing sites that criminals rent to one another.
One arrest did land. The main VenomRAT suspect was detained in Greece on 3 November, a week before the main operational window. Europol said the individual had access to more than 100,000 cryptocurrency wallets, potentially worth millions of euros. Investigators described the dismantled infrastructure as covering hundreds of thousands of infected computers and several million stolen credentials.
Three tools, one supply chain
Rhadamanthys is a malware-as-a-service infostealer. Customers distribute it and collect loot through a web panel: saved logins, browser data, autofill, password-manager contents and crypto-wallet data. VenomRAT gives remote control of a machine, including file theft, cards and authentication cookies; its distribution and licensing domains were among those taken down. Elysium is a proxy botnet. Reporting links it to the same operator that sold Rhadamanthys, meaning infected machines can be turned into rentable proxies for further fraud.
The Register reported that Rhadamanthys' administrator told customers on 11 November to stop using the product "for safety reasons", hours before its onion site disappeared. Shadowserver, which received access to seized data, reported more than 525,000 Rhadamanthys infections between March and November 2025 across 226 countries, and shared victim lists with national CSIRTs and network owners.
Why it matters
Infostealers are the quiet feedstock of modern intrusions. Credentials and session cookies lifted by tools like these routinely resurface in ransomware and data-extortion cases. Hitting the services, not just individual users, drains supply. Police also contacted customers of the criminal services directly through an Operation Endgame Telegram channel, a deliberate attempt to erode trust in the marketplace.
Europol said authorities took down "these three large cybercrime enablers."
Takedowns are rarely permanent. Operators rebrand, and code leaks. But repeated rounds raise costs and sow suspicion among buyers and sellers.
The wider Endgame pattern
Endgame is best read as a campaign, not a single raid. A May 2025 round neutralised roughly 300 servers and 650 domains and seized about 3.5 million euros, so November's 1,025-plus servers is more than a threefold jump in infrastructure hit. The pattern is consistent: rather than chasing every end user of malware, investigators go after the services that sit upstream of many crimes, then announce the results with video and social-media messaging aimed squarely at the criminals themselves.
The aftermath is also a victim-notification exercise. Shadowserver published a report on Rhadamanthys infections observed between mid-March and mid-October 2025 and distributed it to 201 national CSIRTs in 175 countries and more than 10,000 network owners. Proofpoint noted that the law enforcement video suggested the Rhadamanthys operator had also been stealing data from its own affiliates, a reminder that there is little honour among customers of these services.
For defenders, the practical takeaway is less about the three brand names than the behaviour. Infostealers harvest browser-stored passwords, session cookies and wallet data. An employee's personal laptop infected by a stealer can quietly hand an attacker a valid session for a corporate single sign-on portal. Organisations that receive a victim notification should treat it as a live incident: reset the affected passwords, invalidate active sessions and tokens, and check whether the exposed account had access to anything sensitive. Where possible, move staff to phishing-resistant authentication and device-bound sessions, which are harder to replay from a stolen cookie.
What to watch
- Whether the Rhadamanthys operator resurfaces under a new name, and whether further arrests follow.
- Follow-on notifications: victim lists shared with CSIRTs should prompt password resets and session revocations at affected organisations.
- Next Endgame phases, which Europol has said will continue.
Sources
- Rhadamanthys infostealer operation disrupted by law enforcement — Help Net Security
- Rhadamanthys malware admin rattled as cops seize a thousand-plus servers — The Register
- Operation Endgame dismantles — The Hacker News
