News report

# Police takes down 300 servers in ransomware supply-chain crackdown

BleepingComputer, May 23, 2025. The May 2025 Operation Endgame wave - 300 servers and 650 domains taken down between 19 and 22 May 2025, 20 international arrest warrants and EUR 3.5 million in cryptocurrency seized - and, for the two resurgence records that cite it, the fact that Bumblebee and Latrodectus were still live enough a year after the May 2024 Endgame action to be named again among the targeted loader families, alongside Qakbot, DanaBot, Trickbot and Warmcookie..

**Source type:** News report

**Published:** May 23, 2025

**Research grade:** S2

**Used in entries:** 2

## Bibliographic record

**Publisher:** BleepingComputer

**Published:** May 23, 2025

**Source type:** News report

**Research grade:** Source grade S2

**Language:** English

**Official record:** Not an official publication

**Address:** [https://www.bleepingcomputer.com/news/security/police-takes-down-300-servers-in-ransomware-supply-chain-crackdown/](https://www.bleepingcomputer.com/news/security/police-takes-down-300-servers-in-ransomware-supply-chain-crackdown/)

**What it supports:** The May 2025 Operation Endgame wave - 300 servers and 650 domains taken down between 19 and 22 May 2025, 20 international arrest warrants and EUR 3.5 million in cryptocurrency seized - and, for the two resurgence records that cite it, the fact that Bumblebee and Latrodectus were still live enough a year after the May 2024 Endgame action to be named again among the targeted loader families, alongside Qakbot, DanaBot, Trickbot and Warmcookie.

**Dataset id:** src\_bleepingcomputer\_endgame\_300\_servers\_2025

## Research notes

- Byline Sergiu Gatlan. schema.org datePublished 2025-05-23T02:58:13-04:00; dateModified 2025-05-30.
- Scope caution for the citing records: this article is about the May 2025 Endgame action, not about the specific resurgence claims on td\_2024\_endgame\_w1. It does not carry the Netskope October 2024 Bumblebee infection-chain finding or the Proofpoint/Team Cymru IcedID-to-Latrodectus developer attribution; it evidences only that both families were still being targeted in 2025.

How this source is used

Cited 2 times across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Later activity

2 citations

Cited for activity recorded after the takedown.

-
[Bumblebee loader return](https://takedownindex.org/takedowns/operation-endgame-wave-1)

Same operators, Operation Endgame wave 1

Later outcome
-
[Latrodectus](https://takedownindex.org/takedowns/operation-endgame-wave-1)

Rebrand, Operation Endgame wave 1

Later outcome

[All sources](https://takedownindex.org/sources)