Operation Endgame Expands: Europol Adds 131K Email Addresses in Latest Data Breach Wave Europol has released an additional 131,000 email addresses as part of the fourth wave of Operation Endgame, a large-scale cybersecurity crackdown targeting malware and botnet infrastructure. The new dataset, published today, overlaps with existing breach records 36% of the exposed emails were already documented in the Have I Been Pwned database. Operation Endgame, a coordinated effort involving law enforcement agencies across multiple countries, aims to disrupt cybercriminal operations by seizing infrastructure, arresting threat actors, and exposing compromised credentials. This latest update follows prior disclosures, reinforcing the campaign’s ongoing impact on cybercrime networks. The breach data, now publicly accessible, highlights the persistent risk of credential reuse and the scale of cybercriminal targeting. Europol’s continued releases serve as a resource for security teams to identify and mitigate exposure within affected organizations.

Global Authorities Dismantle "AudiA6," a Major Cryptocurrency Laundering Network Linked to Ransomware Groups In a coordinated international operation, law enforcement agencies have dismantled AudiA6, a sophisticated cryptocurrency laundering service that processed over €336 million between 2022 and 2025. The platform, a critical financial hub for ransomware operators and cybercriminal networks, enabled threat actors to obscure illicit funds through rapid, complex transaction chains while evading detection. The takedown, executed on June 10, involved the U.S. Secret Service, IRS Criminal Investigation, Polish law enforcement, Europol, and Eurojust, alongside other global partners. Authorities arrested two suspected administrators one Ukrainian and one Russian in Georgia, seized 30+ servers, took down 25 domains, and froze cryptocurrency assets worth hundreds of thousands of euros. Additional assets, including vehicles and properties, were confiscated, and associated Telegram accounts and dark web platforms were shut down, replaced with official seizure notices. AudiA6 operated as a professional laundering service, advertised on underground forums, allowing cybercriminals including ransomware affiliates to transfer stolen cryptocurrency and receive "cleaned" funds within an hour. The service charged 3–10% commissions and relied on a network of 6,000+ fraudulent accounts, many tied to stolen identities and managed by Russian-speaking intermediaries. These accounts were used to move funds across exchanges, often bypassing compliance checks through commercial email services and custom domains. Investigators also linked AudiA6 to the Dark2Web cybercrime forum, a marketplace for illicit services and a hub for threat actor coordination. Europol connected the platform to 15+ ransomware and cryptocurrency theft investigations, highlighting its role as a central enabler in the cybercrime ecosystem. The operation aligns with Europol’s findings on the growing professionalization of cryptocurrency laundering, where services increasingly use chain-hopping, decentralized exchanges, and mixers to evade anti-money laundering controls. While the takedown disrupts a key financial pipeline for ransomware groups, authorities note that similar services continue to evolve, sustaining the global cybercrime economy.

Europol’s Operation PowerOFF Disrupts Global DDoS-for-Hire Networks Europol, in coordination with 21 national law enforcement agencies, has executed Operation PowerOFF, a large-scale crackdown on DDoS-for-hire (booter) services operating across multiple countries. The operation resulted in four arrests, the seizure of 53 domains, and the execution of 25 search warrants as part of a global effort to dismantle cybercriminal infrastructure. Leading up to the action, authorities conducted operational sprints targeted strikes against high-value users of DDoS-for-hire platforms while raising awareness about the illegality of these services. The takedowns disrupted key technical components, including servers and databases, crippling the infrastructure that enables DDoS attacks. During the operation, law enforcement uncovered three million criminal user accounts linked to the seized platforms. In response, authorities launched a warning campaign, sending 75,000 emails to suspected customers and placing ads on search engines to deter users searching for DDoS-for-hire tools. Additionally, over 100 URLs advertising these services were removed from search results, and blockchain-based warning messages were deployed to disrupt illicit payment channels. DDoS-for-hire services rely on botnets networks of compromised devices, including home routers, smart TVs, and IoT appliances infected with malware. Cybercriminals then rent access to these botnets through simple dashboards, enabling even unskilled attackers to launch disruptive denial-of-service attacks. The operation marks a significant blow to the DDoS-as-a-service ecosystem, reducing the availability of these tools and increasing risks for both providers and users.

In a sophisticated cyberattack campaign, the Carbanak banking Trojan, manipulated by the hacker group Fin7, caused substantial financial loss to banks in over thirty countries. Leveraging a malware, the attackers infiltrated financial institutions' networks through phishing, enabling them to commit ATM jackpotting and compromise point-of-sale data. This operation, detailed by Europol, spanned several years with the criminals meticulously planning each intrusion, which lasted two to four months. The total theft exceeded €1 billion, marking it as one of the most significant financial cybercrimes. The impact extended beyond financial loss, raising concerns about cybersecurity measures in the banking sector and the evolving threats of sophisticated malware. Arrests in Spain and the U.S. have made some headway in dismantling the network, yet the full scope of Carbanak's reach and the current status of Fin7 remain concerning.

In one of the most significant cybercrime investigations, Europol discovered a series of sophisticated malware attacks targeting financial institutions worldwide. The malware, known as Carbanak and later iterations like Odinaff, allowed cybercriminal gangs, notably Fin7, to perform financial theft on an unprecedented scale. Exploiting vulnerabilities in banking security systems, the attackers managed to steal over €1 billion by manipulating ATM systems and point-of-sale terminals, capturing the details of millions of payment cards. The intricate operations involved using malicious documents to compromise financial companies' networks, enabling them to jackpot ATMs and siphon funds through mules into criminal accounts. The impact of these attacks highlights severe shortcomings in cybersecurity protocols within affected organizations, leading to significant financial and reputational damage. Despite arrests in Spain and the U.S., the full extent of the network and the ongoing threat posed by similar malware attacks remain concerns for the global financial sector.

In one of the most significant cyber heists, the Carbanak banking Trojan, attributed to the criminal group Fin7, led to losses exceeding €1 billion across banks in over thirty countries. This meticulously executed operation began with the leak of Carbanak's source code in 2013, empowering several gangs to perpetrate extensive financial theft. Employing spear-phishing tactics, the attackers lured employees of financial institutions to click on malicious documents, facilitating unauthorized network access. This access enabled them to manipulate ATMs for cash withdrawals and compromise point-of-sale systems. The process of each theft spanned months, involving mules to funnel stolen funds into criminal accounts. Despite arrests, including the gang's leader in Spain and three Ukrainian individuals by the U.S. DOJ, the full extent of the network and its operations, including potential ongoing activities, remains partly veiled. Europol's involvement in tackling this cybercriminal enterprise underscores the intricate, cross-border nature of combatting cybercrime, emphasizing the need for robust cybersecurity measures and international cooperation.