Skip to main content
Back to the takedown index

Operation Endgame

May 2024, Multi threat campaign

Verified core entry, last reviewed August 21, 2026

Umbrella campaign. This entry groups 3 recorded actions. Infrastructure, people, and sources sit on each wave rather than on this entry, so read the waves for what was taken down and who was held to account.

Wave Date Lead Outcome
Operation Endgame wave 1 May 27 to May 29, 2024 French Gendarmerie, BKA, and Dutch National Police More than 100 servers disrupted or taken down; more than 2,000 domains brought under law-enforcement control; 16 location searches.
Operation Endgame wave 2 May 19 to May 22, 2025 BKA Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave.
Operation Endgame wave 3 November 10 to November 14, 2025 Not established More than 1,000 servers disrupted; approximately 20 domains seized; access to several hundred thousand infected machines removed from operators.

Recurring French, German, and Dutch-initiated campaign against the malware dropper, loader, and initial-access ecosystem, executed in distinct dated waves.[1]

Announced May 30, 2024.

Date
May 2024
Target
Malware dropper and initial-access ecosystem, campaign
Activity
Multi threat campaign, Malware and botnets, Ransomware
Operational lead
Not established
Jurisdiction
France, Germany, Netherlands, Denmark, United Kingdom, United States, and European Union
Outcome
See child incidents.
Status
Ongoing
Legal mechanism
See child incidents.
Group accounted for
Not applicable

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

Campaign-level record.

Not applicable at campaign level.

Active through the cutoff.[1]

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    Largest ever operation against botnets hits dropper malware ecosystem

    Europol, May 30, 2024, Source grade P2

    Wave 1 infrastructure figures, initiating countries, arrests

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Excluded from incident totals. Children: td_2024_endgame_w1, td_2025_endgame_w2, td_2025_endgame_w3.