Global Malware Network Disrupted in Operation Endgame Europol, Microsoft, and international law enforcement partners have dismantled a vast malware network responsible for stealing 27 million login credentials and infecting over 140,000 computers worldwide. The operation, part of Operation Endgame, targeted cybercrime infrastructure used to deploy ransomware and other large-scale attacks. Authorities seized 326 servers and 142 domains linked to the malware distribution network, while freezing €41 million ($47 million) in suspected criminal crypto assets. The effort involved coordination with Eurojust, Microsoft, and agencies from Germany, the Netherlands, Denmark, the UK, Canada, and the US. The malware tools disrupted included: - SocGholish/FakeUpdates: Spread via fake browser or software updates on compromised websites. - Amadey: Provided initial access to systems, enabling further malware installation. - StealC: Extracted passwords, digital identities, and other sensitive data from infected devices. Microsoft’s Digital Crimes Unit used AI to uncover connections between Amadey and StealC, which were operated by separate groups but shared infrastructure. This allowed the company to dismantle 200 command-and-control servers and free 18,000 victim computers from criminal control. Europol also remediated 14,971 infected websites, including those of small businesses like restaurants and auto repair shops. While the takedown disrupted the network, stolen credentials may still pose risks, as they can be exploited long after the initial breach. The operation highlights the global reach of cybercrime, with infrastructure spanning multiple countries to evade detection.

Global Authorities Dismantle "AudiA6," a Major Cryptocurrency Laundering Network Linked to Ransomware Groups In a coordinated international operation, law enforcement agencies have dismantled AudiA6, a sophisticated cryptocurrency laundering service that processed over €336 million between 2022 and 2025. The platform, a critical financial hub for ransomware operators and cybercriminal networks, enabled threat actors to obscure illicit funds through rapid, complex transaction chains while evading detection. The takedown, executed on June 10, involved the U.S. Secret Service, IRS Criminal Investigation, Polish law enforcement, Europol, and Eurojust, alongside other global partners. Authorities arrested two suspected administrators one Ukrainian and one Russian in Georgia, seized 30+ servers, took down 25 domains, and froze cryptocurrency assets worth hundreds of thousands of euros. Additional assets, including vehicles and properties, were confiscated, and associated Telegram accounts and dark web platforms were shut down, replaced with official seizure notices. AudiA6 operated as a professional laundering service, advertised on underground forums, allowing cybercriminals including ransomware affiliates to transfer stolen cryptocurrency and receive "cleaned" funds within an hour. The service charged 3–10% commissions and relied on a network of 6,000+ fraudulent accounts, many tied to stolen identities and managed by Russian-speaking intermediaries. These accounts were used to move funds across exchanges, often bypassing compliance checks through commercial email services and custom domains. Investigators also linked AudiA6 to the Dark2Web cybercrime forum, a marketplace for illicit services and a hub for threat actor coordination. Europol connected the platform to 15+ ransomware and cryptocurrency theft investigations, highlighting its role as a central enabler in the cybercrime ecosystem. The operation aligns with Europol’s findings on the growing professionalization of cryptocurrency laundering, where services increasingly use chain-hopping, decentralized exchanges, and mixers to evade anti-money laundering controls. While the takedown disrupts a key financial pipeline for ransomware groups, authorities note that similar services continue to evolve, sustaining the global cybercrime economy.

Europol’s Operation PowerOFF Disrupts Global DDoS-for-Hire Networks Europol, in coordination with 21 national law enforcement agencies, has executed Operation PowerOFF, a large-scale crackdown on DDoS-for-hire (booter) services operating across multiple countries. The operation resulted in four arrests, the seizure of 53 domains, and the execution of 25 search warrants as part of a global effort to dismantle cybercriminal infrastructure. Leading up to the action, authorities conducted operational sprints targeted strikes against high-value users of DDoS-for-hire platforms while raising awareness about the illegality of these services. The takedowns disrupted key technical components, including servers and databases, crippling the infrastructure that enables DDoS attacks. During the operation, law enforcement uncovered three million criminal user accounts linked to the seized platforms. In response, authorities launched a warning campaign, sending 75,000 emails to suspected customers and placing ads on search engines to deter users searching for DDoS-for-hire tools. Additionally, over 100 URLs advertising these services were removed from search results, and blockchain-based warning messages were deployed to disrupt illicit payment channels. DDoS-for-hire services rely on botnets networks of compromised devices, including home routers, smart TVs, and IoT appliances infected with malware. Cybercriminals then rent access to these botnets through simple dashboards, enabling even unskilled attackers to launch disruptive denial-of-service attacks. The operation marks a significant blow to the DDoS-as-a-service ecosystem, reducing the availability of these tools and increasing risks for both providers and users.

In a sophisticated cyberattack campaign, the Carbanak banking Trojan, manipulated by the hacker group Fin7, caused substantial financial loss to banks in over thirty countries. Leveraging a malware, the attackers infiltrated financial institutions' networks through phishing, enabling them to commit ATM jackpotting and compromise point-of-sale data. This operation, detailed by Europol, spanned several years with the criminals meticulously planning each intrusion, which lasted two to four months. The total theft exceeded €1 billion, marking it as one of the most significant financial cybercrimes. The impact extended beyond financial loss, raising concerns about cybersecurity measures in the banking sector and the evolving threats of sophisticated malware. Arrests in Spain and the U.S. have made some headway in dismantling the network, yet the full scope of Carbanak's reach and the current status of Fin7 remain concerning.

In one of the most significant cybercrime investigations, Europol discovered a series of sophisticated malware attacks targeting financial institutions worldwide. The malware, known as Carbanak and later iterations like Odinaff, allowed cybercriminal gangs, notably Fin7, to perform financial theft on an unprecedented scale. Exploiting vulnerabilities in banking security systems, the attackers managed to steal over €1 billion by manipulating ATM systems and point-of-sale terminals, capturing the details of millions of payment cards. The intricate operations involved using malicious documents to compromise financial companies' networks, enabling them to jackpot ATMs and siphon funds through mules into criminal accounts. The impact of these attacks highlights severe shortcomings in cybersecurity protocols within affected organizations, leading to significant financial and reputational damage. Despite arrests in Spain and the U.S., the full extent of the network and the ongoing threat posed by similar malware attacks remain concerns for the global financial sector.

In one of the most significant cyber heists, the Carbanak banking Trojan, attributed to the criminal group Fin7, led to losses exceeding €1 billion across banks in over thirty countries. This meticulously executed operation began with the leak of Carbanak's source code in 2013, empowering several gangs to perpetrate extensive financial theft. Employing spear-phishing tactics, the attackers lured employees of financial institutions to click on malicious documents, facilitating unauthorized network access. This access enabled them to manipulate ATMs for cash withdrawals and compromise point-of-sale systems. The process of each theft spanned months, involving mules to funnel stolen funds into criminal accounts. Despite arrests, including the gang's leader in Spain and three Ukrainian individuals by the U.S. DOJ, the full extent of the network and its operations, including potential ongoing activities, remains partly veiled. Europol's involvement in tackling this cybercriminal enterprise underscores the intricate, cross-border nature of combatting cybercrime, emphasizing the need for robust cybersecurity measures and international cooperation.