Operation Endgame

Campaign
13 incidents First seen 2026-01-13 Last seen 2026-10-27
Overview

Operation Endgame, a coordinated international effort by Europol and its partners, disrupted the networks linked to several ransomware gangs, including Bumblebee, SocGholish, LockBit Black, FakeUpdates, Amadey, and LockBit 3.0. The operation targeted cryptocurrency and health sectors across multiple countries, resulting in over 25.6 million unique stolen credentials taken from compromised systems. Additionally, Dutch authorities arrested a suspect believed to be the mastermind behind AVCheck malware, which was also disrupted as part of Operation Endgame. This operation is considered one of the largest international efforts against ransomware enablers worldwide, with significant disruptions to online services and critical infrastructure.

Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
Activity by month (incidents)
2026-012026-10
Sectors targeted
government · 4education · 3health · 3finance · 2technology · 2aviation · 1cryptocurrency · 1hospitality · 1
Countries targeted
NL · 7BE · 6LU · 6CA · 5RU · 5AT · 4CH · 4DE · 4FR · 4US · 4DK · 3GB · 3
Origin
CA · 6US · 5GB · 3RU · 3AO · 2AT · 2
Kinds of incident
Malware & Botnets · 7Law Enforcement · 5Ransomware & Extortion · 3Industry & Policy · 2AI-Enabled Attack · 1DDoS & Disruption · 1
Techniques seen in incidents
Ransomware · 8Phishing · 6Extortion · 5T1588.001 - Malware · 5Botnet · 4Espionage · 3T1059.001 - PowerShell · 3T1592.002 - Software · 3Ddos · 2T1059.007 - JavaScript · 2T1566 - Phishing · 2Credential Stuffing · 1Exfiltration · 1Impersonation · 1
Related malware
SocGholish · 5Amadey · 3FakeUpdates · 3Dridex · 2IcedID · 2LockBit 3.0 · 2LockBit Black · 2RansomHub · 2
Related actors
Indrik Spider · 1Mustard Tempest · 1
Incident timeline
2026-10-27
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
2026-10-26
StealC Malware Returns as Stadia RAT After Operation Endgame Takedown
2026-10-22
StealC Is Back, and This Time It's a RAT
AlienVault OTX
2026-09-10
The Top 4 Threats We Found by Investigating Every Alert for a Quarter
2026-07-27
FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown
2026-07-23
Fake Claude app promoted by Bing ads pushes SectopRAT malware
2026-03-11
France: National Cybersecurity Agency Reports Ransomware Attack Drop in 2025
2026-03-04
Dark Reading Confidential: This Threat Hunter Helped Cops Bust Up An African Cybercrime Syndicate
2026-01-30
Badges, Bytes and Blackmail
2026-01-13
Dutch cops cuff alleged AVCheck malware kingpin in Amsterdam