Skip to main content
Back to the takedown index

Operation Ladybird

January 2021, Malware and botnets
Led by Politie (Netherlands National Police), Bundeskriminalamt

Verified core entry, last reviewed August 21, 2026

What was taken down?

Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.[1][2][3]

See what happened

What happened to the people?

Officials reported 2 apprehended.
Group accounted for: Partial

See people and accountability

Did it stay down?

After this action the service returned on replacement infrastructure, first seen November 2021. No later seizure of the replacement is recorded. High confidence in the link between the two.

See what happened afterward

Europol- and Eurojust-coordinated operation in which national authorities took control of Emotet's command-and-control infrastructure from the inside and redirected infected machines to law-enforcement-controlled servers.[1][2][3]

Announced January 27, 2021.

Date
January 26 to January 27, 2021
Target
Emotet, modular botnet loader
Activity
Malware and botnets, Ransomware
Operational lead
Dutch National Police and BKA
Partners
Europol, Eurojust, and 1 more[1]
Jurisdiction
Netherlands, Germany, United States, United Kingdom, France, Lithuania, Canada, Ukraine, and European Union
Outcome
Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.
Status
Completed
Legal mechanism
Judicial authorization across participating states including Dutch and German court process; US court authorization for the uninstall payload; EMPACT framework
Group accounted for
Partial

Infrastructure

700 command and control servers taken over and 1,600,000 malware installations remediated.

approximately 700
command and control servers taken over
approximately 1,600,000
malware installations remediated
Identifier Recorded as Status Notes
Not published approximately 700 command and control servers Taken over Approximately 700 command-and-control servers taken over and repurposed to control infected machines.[1]
Not published approximately 1,600,000 malware installations Remediated Infected machines redirected to law-enforcement infrastructure and later served a court-authorized uninstall module triggered 2021-04-25.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Partial

Two individuals were detained in Ukraine, but the malware returned within ten months, demonstrating that core operators remained active.

Core group commonly tracked as a distinct crew but never publicly enumerated by authorities.

See the organizations and roles behind this action

Emotet returned in November 2021 on new infrastructure.[1][2][3]

  1. November 2021

    Emotet resurgence. Same service on replacement infrastructure. Confidence: High. No later seizure recorded.[2][3]

    Emotet returned on new infrastructure roughly ten months after the takedown, rebuilt with assistance from the Trickbot operation and documented by multiple independent technical vendors.

November 2021

Emotet resurgence. Same service on replacement infrastructure. Confidence: High. No later seizure recorded.[2][3]

Emotet returned on new infrastructure roughly ten months after the takedown, rebuilt with assistance from the Trickbot operation and documented by multiple independent technical vendors.

Return class B. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    World's most dangerous malware EMOTET disrupted through global action

    Europol, January 27, 2021, Source grade P2

    Infrastructure takeover, participating authorities, Ukrainian arrests, infection scale

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Additional reporting and technical analysis

  1. [2]
    Emotet botnet disrupted following global law enforcement operation

    ESET WeLiveSecurity, January 28, 2021, Source grade T2

    Technical description of the takeover and the planned uninstall module

    Open source
  2. [3]
    Will Emotet ever bounce back?

    SecAlliance, Source grade T2

    Emotet's November 2021 return and rebuild

    Open source
Coverage note.
  • Approximately 1.6 million infected machines is a victim-side figure.
  • The delayed uninstall on 2021-04-25 is recorded as part of this incident rather than as a separate takedown because it operated on infrastructure already under law-enforcement control.
  • The November 2021 return is recorded as a resurgence.