What was taken down?
Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave.[1][2][4]
See what happenedWhat happened to the people?
Officials reported 20 charged.
3 charged and 1 publicly wanted named in the public record.
Group accounted for: Members remain at large
Did it stay down?
Not established in the public record. No later activity is recorded against this entry.
See what happened afterwardSecond Endgame wave targeting initial-access malware and loaders, combining infrastructure seizure with a large set of criminal charges including the DanaBot indictment and the Qakbot administrator.[1][2][4]
Announced May 23, 2025.
- Date
- May 19 to May 22, 2025
- Target
- DanaBot, Bumblebee, Lactrodectus, Qakbot, HijackLoader, Trickbot, Warmcookie, malware dropper ecosystem
- Activity
- Multi threat campaign, Malware and botnets, Ransomware, Fraud and stolen data
- Operational lead
- BKA
- Jurisdiction
- Germany, Netherlands, France, Denmark, United Kingdom, United States, and Canada
- Outcome
- Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave.
- Status
- Completed
- Legal mechanism
- National judicial orders across participating states; US indictments (Central District of California and others); Europol and Eurojust coordination
- Group accounted for
- Members remain at large
Infrastructure
300 servers disabled and 650 domains seized.
- approximately 300
- servers disabled
- approximately 650
- domains seized
| Identifier | Recorded as | Status | Notes |
|---|---|---|---|
| Not published | approximately 300 servers | Disabled | Approximately 300 servers disrupted worldwide.[4] |
| Not published | approximately 650 domains | Seized | Approximately 650 domains neutralized.[4] |
Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.
- 3
- charged
- 1
- publicly wanted
Named in the public record: 3 charged and 1 publicly wanted.
Figures count individuals named in charging documents and official statements, each person once per outcome. People alleged to be involved but not publicly identified are not counted.
| Person | Role | Current public status |
|---|---|---|
| Lead defendant, DanaBot malware scheme | Charged | |
|
||
| Lead defendant, DanaBot malware scheme | Charged | |
|
||
| Leader and developer of the Qakbot botnet | ChargedPublicly wanted | |
|
||
Aleksandr Stepanov
Lead defendant, DanaBot malware scheme. Current public status: Charged.
- Charging authority
- United States Attorney's Office for the Central District of California
- Main charges
- Not established in the public record
- Case number
- Not established in the public record
- Arresting authority
- Not established in the public record
- Arrest location
- Not established in the public record
- Extradition status
- Not established in the public record
- Conviction or plea
- Not established in the public record
- Sentence
- Not established in the public record
- Segment
- Core operator
- Sources
- [3]
- Full record
- Everything indexed for Aleksandr Stepanov
Artem Aleksandrovich Kalinkin
Lead defendant, DanaBot malware scheme. Current public status: Charged.
- Charging authority
- United States Attorney's Office for the Central District of California
- Main charges
- Not established in the public record
- Case number
- Not established in the public record
- Arresting authority
- Not established in the public record
- Arrest location
- Not established in the public record
- Extradition status
- Not established in the public record
- Conviction or plea
- Not established in the public record
- Sentence
- Not established in the public record
- Segment
- Core operator
- Sources
- [3]
Rustam Rafailevich Gallyamov
Leader and developer of the Qakbot botnet. Current public status: Charged and Publicly wanted.
- Charging authority
- United States Attorney's Office for the Central District of California
- Main charges
- Conspiracy to commit computer fraud
- Case number
- Not established in the public record
- Arresting authority
- Not established in the public record
- Arrest location
- Not established in the public record
- Extradition status
- Not established in the public record
- Conviction or plea
- Not established in the public record
- Sentence
- Not established in the public record
- Segment
- Core operator
- Sources
- [1]
Rows expand to show charging authority, case identifiers, custody status, and sources.
Group accounted for: Members remain at large
Authorities announced international targets who remained at large, and the DanaBot defendants were largely charged in absentia.
Multiple distinct malware crews targeted in one wave.
Prosecutions ongoing; cumulative Endgame cryptocurrency seizures reported at approximately 21.2 million EUR.[1][2][4]
Not established in the public record. No later activity is recorded against this entry.
Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.
Numbered markers throughout this entry link to the source that supports the claim beside them.
Official sources
-
[1]
US Department of Justice announcement charging the alleged Qakbot leader and seizing cryptocurrency
Gallyamov charge, continued operation after the 2023 takedown
-
[2]
United States v. Aleksandr Stepanov et al., DanaBot indictment
16-defendant DanaBot charges announced with the Endgame wave
-
[3]
16 defendants federally charged in connection with DanaBot malware scheme
Names lead defendants Aleksandr Stepanov ('JimmBee') and Artem Kalinkin ('Onix') among 16 charged in the DanaBot scheme (part of Operation Endgame wave 2).
-
[4]
Europol release on Operation Endgame's 2025 action against initial access malware
Wave 2 infrastructure figures, charges, cryptocurrency seizures
- The DanaBot indictment names 16 defendants, most believed to be in Russia. Only Gallyamov is carried as a named person record in this pass; the remaining DanaBot defendants are a documented gap.
- Reported charged count of 20 is an official aggregate and is not equal to the number of named person records.