Skip to main content

News report

Police takes down 300 servers in ransomware supply-chain crackdown

BleepingComputer, May 23, 2025. The May 2025 Operation Endgame wave - 300 servers and 650 domains taken down between 19 and 22 May 2025, 20 international arrest warrants and EUR 3.5 million in cryptocurrency seized - and, for the two resurgence records that cite it, the fact that Bumblebee and Latrodectus were still live enough a year after the May 2024 Endgame action to be named again among the targeted loader families, alongside Qakbot, DanaBot, Trickbot and Warmcookie..

Source type
News report
Published
May 23, 2025
Research grade
S2
Used in entries
2

Bibliographic record

Publisher
BleepingComputer
Published
May 23, 2025
Source type
News report
Research grade
Source grade S2
Language
English
Official record
Not an official publication
Address
https://www.bleepingcomputer.com/news/security/police-takes-down-300-servers-in-ransomware-supply-chain-crackdown/
What it supports
The May 2025 Operation Endgame wave - 300 servers and 650 domains taken down between 19 and 22 May 2025, 20 international arrest warrants and EUR 3.5 million in cryptocurrency seized - and, for the two resurgence records that cite it, the fact that Bumblebee and Latrodectus were still live enough a year after the May 2024 Endgame action to be named again among the targeted loader families, alongside Qakbot, DanaBot, Trickbot and Warmcookie.
Dataset id
src_bleepingcomputer_endgame_300_servers_2025

Research notes

  • Byline Sergiu Gatlan. schema.org datePublished 2025-05-23T02:58:13-04:00; dateModified 2025-05-30.
  • Scope caution for the citing records: this article is about the May 2025 Endgame action, not about the specific resurgence claims on td_2024_endgame_w1. It does not carry the Netskope October 2024 Bumblebee infection-chain finding or the Proofpoint/Team Cymru IcedID-to-Latrodectus developer attribution; it evidences only that both families were still being targeted in 2025.

How this source is used

Cited 2 times across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

Cited by

Later activity

2 citations

Cited for activity recorded after the takedown.

All sources