Operation Endgame: Europe's biggest takedown

With Operation Endgame 3.0, law enforcement agencies coordinated by Europol and Eurojust took down or disrupted more than 1,025 servers between 10 and 13 November 2025. The servers were used to spread malware and control botnets. Measured by the number of servers, this is the largest phase of the operation so far. According to Europol, 20 domains were also seized and eleven locations in Germany, Greece and the Netherlands were searched. The main suspect behind VenomRAT had already been arrested in Greece on 3 November.

For all its success, the operation shows one thing above all: the industrial complexity of cybercriminal networks keeps growing and evolving. So does the pressure on companies to detect compromised systems and identities early.

What the investigators found

The servers that were taken down belonged to three services that, according to Europol, played a key role in international cybercrime. Operation Endgame deliberately targets such ransomware enablers: tools that attackers use to gain unnoticed access to systems before ransomware is deployed.

The targets were:

• Rhadamanthys, one of the largest infostealers, which harvests credentials from infected computers
• VenomRAT, a remote access trojan that lets attackers control infected devices remotely
• Elysium, a botnet whose infected computers are controlled via command-and-control (C2) servers

Europol describes the scale as follows: the dismantled infrastructure comprised hundreds of thousands of infected computers holding several million stolen credentials, and many victims were unaware of the infection. The main suspect behind the infostealer had access to more than 100,000 of the victims' crypto wallets.

Infrastructure like this is the backbone of the malware economy. It provides distribution, automation and, ultimately, monetisation. Taking it down is an important success – but not a final one.

Why Endgame 3.0 is only an interim step

Law enforcement action like this treats symptoms. It does nothing about the exploitation of vulnerabilities inside companies. After a takedown, the actors usually reorganise within a few weeks, or other groups fill the power vacuum.

The underlying problems remain:

• Infostealer data is still in circulation: stolen credentials continue to be sold and abused.
• Compromised identities are often detected too late, because systematic monitoring is missing.
• Initial attack vectors remain open: unpatched services, weak access controls or shadow IT.
• Criminal infrastructure is decentralised, for example across previously compromised cloud accounts, which makes it more resilient.

The result: even when servers are switched off, corporate access, tokens and compromised identities stay in circulation – and continue to be attacked automatically.

What companies need to take away from Endgame 3.0

The operation shows how much modern cybercrime relies on division of labour and tightly linked services. For companies, three fields of action follow:

1. Stolen identities must be managed as a risk area of their own. Infostealer dumps contain e-mail passwords, browser cookies, session tokens, VPN access and API keys. Without targeted monitoring, this material only resurfaces after an attack.
2. Supply chains and legacy systems are still the weakest links. Attackers increasingly rely on droppers, loaders and already compromised frameworks. Early detection decides how much damage is done.
3. Reactive measures are not enough. Takedowns such as Endgame 3.0 matter, but they offer no lasting protection. Without continuous visibility of identity and infrastructure leaks, companies remain vulnerable.

How blacklens.io supports companies in this situation

blacklens.io was built to cover exactly the blind spots that Operation Endgame 3.0 exposes so clearly:

• Detection of compromised identities and systems: Dark Web Monitoring reports a company's passwords, session cookies and personal data that turn up in infostealer logs or combolists, as well as compromised devices with hostname, operating system and infection date.
• Context instead of bare alerts: blacklens.io automatically classifies whether the data belongs to employees or to customers, and shows whether it came from infostealer malware or a combolist. That distinction drives prioritisation and response speed.
• Automatable follow-up steps: notification policies route alerts by e-mail, push notification or integration, for example to Jira, ServiceNow, Microsoft Teams, Slack or a generic webhook. Teams can connect their own follow-up steps through the REST API.
• One view of the attack surface: blacklens.io links identity leaks, system exposure and infrastructure context. That enables preventive defences and targeted patching before attackers become active.

Resilience comes from continuous transparency

Operation Endgame 3.0 is a major success for European cyber defence. At the same time, it shows how deeply rooted and well organised modern cybercrime networks are – and how little companies can rely on infrastructure takedowns alone.

Real resilience only comes from continuous transparency: about identity-related risks, about compromised systems and about where attacks originate. Companies that understand their own attack surface and detect compromised identities early stay able to act, even as criminal ecosystems keep re-forming.