Category

# Multi country cybercrime campaigns

Coordinated operations that acted against several unrelated criminal services at once, usually across many countries on a single action day.

Records 5 2024 to 2025

Infrastructure 6 Items recorded as acted on

People named 9 Distinct people in these records

Sources 8 Cited across the category

## What this category covers

Campaign level records where the reported totals cover many targets at once. Where a campaign ran in waves, each wave is recorded separately so nothing is counted twice.

Every entry below is an action that was carried out, not an announcement of intent. The [counting rules](https://takedownindex.org/about/counting-incidents) and the [inclusion definition](https://takedownindex.org/about/what-counts) apply to this category exactly as they apply to the rest of the index.

What the record does not settle

- 0 of 5 records have a documented successor. Silence in the other rows is not evidence that a service stayed down.
- 1 record carries no established start date.
- Reported figures come from the acting authorities. Named figures come from people recorded individually here. The two are never added together.

## Chronology

| Date | Takedown | Target | Led by | Jurisdictions |
| --- | --- | --- | --- | --- |
| May 27, 2024 | [Operation Endgame wave 1](https://takedownindex.org/takedowns/operation-endgame-wave-1) | IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, Trickbot | French Gendarmerie, BKA, and Dutch National Police | International |
| May 19, 2025 | [Operation Endgame wave 2](https://takedownindex.org/takedowns/operation-endgame-wave-2) | DanaBot, Bumblebee, Lactrodectus, Qakbot, HijackLoader, Trickbot, Warmcookie | BKA | International |
| Jul 18, 2025 | [INTERPOL Synergia III](https://takedownindex.org/takedowns/interpol-synergia-iii) | Heterogeneous malicious infrastructure | INTERPOL | Not established |
| Nov 10, 2025 | [Operation Endgame wave 3](https://takedownindex.org/takedowns/operation-endgame-wave-3) | Rhadamanthys, VenomRAT, Elysium botnet | Not established | International |
| April 2024 | [INTERPOL Synergia II](https://takedownindex.org/takedowns/interpol-synergia-ii) | Heterogeneous malicious infrastructure (phishing, malware, ransomware C2) | INTERPOL | Not established |

## Who leads these actions

- [BKA](https://takedownindex.org/organizations/bundeskriminalamt)2 records
- [INTERPOL](https://takedownindex.org/organizations/international-criminal-police-organization)2 records
- [French Gendarmerie](https://takedownindex.org/organizations/gendarmerie-nationale)1 record
- [Dutch National Police](https://takedownindex.org/organizations/politie-netherlands-national-police)1 record

## Where they were carried out

- Germany3 records
- France3 records
- United Kingdom3 records
- Netherlands3 records
- United States3 records
- Denmark2 records
- Armenia1 record
- Bulgaria1 record

A takedown is counted once for every country named in its geographic scope, so these figures sum to more than 5.

[Filter the full index by this category](https://takedownindex.org/takedowns?activity_type=multi_threat_campaign)