[Back to the takedown index](https://takedownindex.org/takedowns)

# Operation Endgame

May 2024, Multi threat campaign

Source linked. Verified August 21, 2026.

Umbrella campaign. This entry groups 3 recorded actions. Infrastructure, people, and sources sit on each wave rather than on this entry, so read the waves for what was taken down and who was held to account.

## Waves in this campaign

| Wave | Date | Lead | Outcome |
| --- | --- | --- | --- |
| [Operation Endgame wave 1](https://takedownindex.org/takedowns/operation-endgame-wave-1) | May 27 to May 29, 2024 | French Gendarmerie, BKA, and Dutch National Police | More than 100 servers disrupted or taken down; more than 2,000 domains brought under law-enforcement control; 16 location searches. |
| [Operation Endgame wave 2](https://takedownindex.org/takedowns/operation-endgame-wave-2) | May 19 to May 22, 2025 | BKA | Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave. |
| [Operation Endgame wave 3](https://takedownindex.org/takedowns/operation-endgame-wave-3) | November 10 to November 13, 2025 | Not established | 1,025 servers taken down or disrupted; 20 domains seized; one VenomRAT suspect arrested in Greece on 2025-11-03. |

## What happened

Recurring French, German, and Dutch-initiated campaign against the malware dropper, loader, and initial-access ecosystem, executed in distinct dated waves.[[1]](#source-1)

Announced May 30, 2024.

**Date:** May 2024

**Target:** Malware dropper and initial-access ecosystem, campaign

**Activity:** Multi threat campaign, Malware and botnets, Ransomware

**Operational lead:** Not established

**Jurisdiction:** France, Germany, Netherlands, Denmark, United Kingdom, United States, and European Union

**Outcome:** See child incidents.

**Status:** Ongoing

**Legal mechanism:** See child incidents.

**Group accounted for:** Not applicable

## People and accountability

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

Campaign-level record.

Not applicable at campaign level.

## What happened afterward

Active through the cutoff.[[1]](#source-1)

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about).

## Sources

Numbered markers throughout this entry link to the source that supports the claim beside them.

### What each part of this entry rests on

The audit recorded which sources carry which part of the record. These are those sources.

- Identity, dates and counts, [[1]](#source-1) [Largest ever operation against botnets hits dropper malware ecosystem](https://takedownindex.org/sources/europol-largest-ever-operation-against-botnets-hits-dropper-malware-ecosystem)

### Official sources

1.
[Largest ever operation against botnets hits dropper malware ecosystem](https://takedownindex.org/sources/europol-largest-ever-operation-against-botnets-hits-dropper-malware-ecosystem)

Europol, May 30, 2024, Source grade P2

Wave 1 infrastructure figures, initiating countries, arrests

[Open source](https://www.europol.europa.eu/media-press/newsroom/news/largest-ever-operation-against-botnets-hits-dropper-malware-ecosystem)

Coverage note. Excluded from incident totals. Children: td\_2024\_endgame\_w1, td\_2025\_endgame\_w2, td\_2025\_endgame\_w3.

Research context

## How this entry was checked

Source linked

Every claim in this entry traces to a source the audit opened and read. Nothing on the record needed changing.

Verified: August 21, 2026

Sources cited: 1

Research cutoff: August 21, 2026

Limitations recorded against this entry

- Campaign-level record; personnel and legal outcomes belong to child incidents and are not independently counted here.

See also

[About the Internet Takedown Index](https://takedownindex.org/about)

Related entries

- [Operation Endgame wave 1](https://takedownindex.org/takedowns/operation-endgame-wave-1)
- [Operation Endgame wave 2](https://takedownindex.org/takedowns/operation-endgame-wave-2)
- [INTERPOL Synergia III](https://takedownindex.org/takedowns/interpol-synergia-iii)

Report updates or corrections

Help keep this record accurate.

[Submit feedback](https://takedownindex.org/about/corrections-and-updates)