[Back to the takedown index](https://takedownindex.org/takedowns)

[Operation Endgame](https://takedownindex.org/takedowns/operation-endgame)

# Operation Endgame wave 3

November 2025, Multi threat campaign

Verified core entry, last reviewed August 21, 2026

What was taken down?

More than 1,000 servers disrupted; approximately 20 domains seized; access to several hundred thousand infected machines removed from operators.[[1]](#source-1)

[See what happened](#what-happened)

What happened to the people?

Officials reported 1 apprehended.
Group accounted for: Partial

[See people and accountability](#people)

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

[See what happened afterward](#afterward)

## What happened

Third Endgame wave targeting infostealer and remote-access-trojan infrastructure, with a principal VenomRAT suspect arrested in Greece.[[1]](#source-1)

Announced November 14, 2025.

**Date:** November 10 to November 14, 2025

**Target:** Rhadamanthys, VenomRAT, Elysium botnet, infostealer and rat infrastructure

**Activity:** Multi threat campaign, Malware and botnets, Fraud and stolen data

**Operational lead:** Not established

**Partners**

Europol, Hellenic Police[[1]](#source-1)

- [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation), coordinator
- [Hellenic Police](https://takedownindex.org/organizations/hellenic-police), arresting

**Jurisdiction:** Germany, Netherlands, France, Greece, United Kingdom, United States, and European Union

**Outcome:** More than 1,000 servers disrupted; approximately 20 domains seized; access to several hundred thousand infected machines removed from operators.

**Status:** Completed

**Legal mechanism:** National judicial orders; European Arrest Warrant; Europol and Eurojust coordination

**Group accounted for:** Partial

### Infrastructure

1,000 servers disabled and 20 domains seized.

| Identifier | Recorded as | Status | Notes |
| --- | --- | --- | --- |
| Not published | more than 1,000 servers | Disabled | More than 1,000 servers disrupted.[[1]](#source-1) |
| Not published | approximately 20 domains | Seized | Approximately 20 domains seized.[[1]](#source-1) |

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

## People and accountability

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Partial

One principal suspect was arrested; the Rhadamanthys and Elysium operator groups were not publicly accounted for.

Multiple distinct malware operations targeted.

[See the organizations and roles behind this action](https://takedownindex.org/takedowns/operation-endgame-wave-3/organizations)

## What happened afterward

Prosecutions ongoing as of the cutoff.[[1]](#source-1)

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about).

## Sources

Numbered markers throughout this entry link to the source that supports the claim beside them.

### Official sources

1.
[Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and Elysium](https://takedownindex.org/sources/europol-europol-release-on-the-november-2025-operation-endgame-action-against-rh)

Europol, November 14, 2025, Source grade P2

Wave 3 infrastructure figures and the Greek arrest

No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
- SUPPORTING-SOURCE GAP. Only the international coordinator release was located in this pass; a second participating national authority release should be added.
- VenomRAT suspect arrested in Greece on 2025-11-03, before the main action window.

Research context

## How this entry was checked

This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source.

Source review: Verified core

Sources cited: 1

Research cutoff: August 20, 2026

Last reviewed August 21, 2026

See also

[About the Internet Takedown Index](https://takedownindex.org/about)

Related entries

- [INTERPOL Synergia III](https://takedownindex.org/takedowns/interpol-synergia-iii)
- [Operation Endgame wave 2](https://takedownindex.org/takedowns/operation-endgame-wave-2)
- [INTERPOL Synergia II](https://takedownindex.org/takedowns/interpol-synergia-ii)

Report updates or corrections

Help keep this record accurate.

[Submit feedback](https://takedownindex.org/about#corrections-and-updates)