Operation End Game 2.0: Targeting Initial Access Brokers

In a joint operation spearheaded by European law enforcement, authorities have dismantled a complex cybercriminal network, taking down 300 servers globally. This initiative, which spanned from May 19 to May 22, aimed to confront malware integral to various cybercrime activities, particularly ransomware.

During this sophisticated operation, known as “Operation Endgame,” law enforcement agencies from Europe, the UK, and the United States neutralized 650 domains associated with several notorious malware strains, such as Bumblebee, Lactrodectus, Qakbot, Hijackloader, DanaBot, Trickbot, and Warmcookie. Europol described this effort as a decisive strike against the ransomware supply chain.

As part of this extensive crackdown, international arrest warrants were issued for 20 suspects, primarily Russian nationals with prior allegations of malware development. This operation built upon a similar initiative conducted a year ago, where authorities also targeted botnets in what Europol identified as the most significant international operation against such networks to date.

This year’s operation has focused on emerging malware variants and newly formed groups that reestablished themselves following last year’s interventions. According to Europol, these developments underscore law enforcement’s capability to adapt and respond to the evolving landscape of cybercrime.

The coordinated effort coincided with a broader campaign against cyber threats, which saw U.S. authorities seizing command and control servers used by operators of DanaBot malware, alongside revealing indictments against 16 members of a Russia-based cybercrime syndicate connected to these operations.

Additionally, U.S. law enforcement in collaboration with Microsoft announced the seizure of critical infrastructure related to the Lumma Stealer, while also unveiling an indictment against Russian national Rustam Rafailevich Gallyamov for his role in managing the Qakbot malware since its inception as a banking Trojan in 2008.

Malware identified in these actions has often served as an entry point for ransomware attacks, with cybercriminals frequently engaging in a symbiotic relationship, in which initial compromises lead to profitable access sales or collaborative efforts with ransomware groups.

The latest operation targeted numerous domains, including 50 servers located in Germany. The Public Prosecutor’s Office in Frankfurt has since included 18 individuals associated with Trickbot and Qakbot on the EU’s Most Wanted list, revealing the extensive reach of this organized cybercrime network.