[Back to the takedown index](https://takedownindex.org/takedowns) # Operation Ladybird January 2021, Malware and botnets Led by [Politie (Netherlands National Police)](https://takedownindex.org/organizations/politie-netherlands-national-police), [Bundeskriminalamt](https://takedownindex.org/organizations/bundeskriminalamt) Verified core entry, last reviewed August 21, 2026 What was taken down? Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) [See what happened](#what-happened) What happened to the people? Officials reported 2 apprehended. Group accounted for: Partial [See people and accountability](#people) Did it stay down? After this action the service returned on replacement infrastructure, first seen November 2021. No later seizure of the replacement is recorded. High confidence in the link between the two. [See what happened afterward](#afterward) ## What happened Europol- and Eurojust-coordinated operation in which national authorities took control of Emotet's command-and-control infrastructure from the inside and redirected infected machines to law-enforcement-controlled servers.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) Announced January 27, 2021. **Date:** January 26 to January 27, 2021 **Target:** Emotet, modular botnet loader **Activity:** Malware and botnets, Ransomware **Operational lead:** Dutch National Police and BKA **Partners** Europol, Eurojust, and 1 more[[1]](#source-1) - [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation), coordinator - [European Union Agency for Criminal Justice Cooperation](https://takedownindex.org/organizations/european-union-agency-for-criminal-justice-cooperation), judicial cooperation - [Cyberpolice Department of the National Police of Ukraine](https://takedownindex.org/organizations/cyberpolice-department-of-the-national-police-of-ukraine), arresting **Jurisdiction:** Netherlands, Germany, United States, United Kingdom, France, Lithuania, Canada, Ukraine, and European Union **Outcome:** Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25. **Status:** Completed **Legal mechanism:** Judicial authorization across participating states including Dutch and German court process; US court authorization for the uninstall payload; EMPACT framework **Group accounted for:** Partial ### Infrastructure 700 command and control servers taken over and 1,600,000 malware installations remediated. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | Not published | approximately 700 command and control servers | Taken over | Approximately 700 command-and-control servers taken over and repurposed to control infected machines.[[1]](#source-1) | | Not published | approximately 1,600,000 malware installations | Remediated | Infected machines redirected to law-enforcement infrastructure and later served a court-authorized uninstall module triggered 2021-04-25.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved. Group accounted for: Partial Two individuals were detained in Ukraine, but the malware returned within ten months, demonstrating that core operators remained active. Core group commonly tracked as a distinct crew but never publicly enumerated by authorities. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/operation-ladybird/organizations) ## What happened afterward Emotet returned in November 2021 on new infrastructure.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) November 2021 Emotet resurgence. Same service on replacement infrastructure. Confidence: High. No later seizure recorded.[[2]](#source-2)[[3]](#source-3) Emotet returned on new infrastructure roughly ten months after the takedown, rebuilt with assistance from the Trickbot operation and documented by multiple independent technical vendors. Return class B. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [World's most dangerous malware EMOTET disrupted through global action](https://takedownindex.org/sources/europol-world-s-most-dangerous-malware-emotet-disrupted-through-global-action) Europol, January 27, 2021, Source grade P2 Infrastructure takeover, participating authorities, Ukrainian arrests, infection scale No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. ### Additional reporting and technical analysis 1. [Emotet botnet disrupted following global law enforcement operation](https://takedownindex.org/sources/eset-welivesecurity-emotet-botnet-disrupted-following-global-law-enforcement-ope) ESET WeLiveSecurity, January 28, 2021, Source grade T2 Technical description of the takeover and the planned uninstall module [Open source](https://www.welivesecurity.com/2021/01/28/emotet-botnet-disrupted-global-operation/) 2. [Will Emotet ever bounce back?](https://takedownindex.org/sources/secalliance-will-emotet-ever-bounce-back) SecAlliance, Source grade T2 Emotet's November 2021 return and rebuild [Open source](https://www.secalliance.com/blog/will-emotet-ever-bounce-back) Coverage note. - Approximately 1.6 million infected machines is a victim-side figure. - The delayed uninstall on 2021-04-25 is recorded as part of this incident rather than as a separate takedown because it operated on infrastructure already under law-enforcement control. - The November 2021 return is recorded as a resurgence. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 3 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [Sky ECC interception and action day](https://takedownindex.org/takedowns/sky-ecc-interception-and-action-day) - [DarkMarket shutdown](https://takedownindex.org/takedowns/darkmarket-shutdown) - [Boystown CSAM platform takedown](https://takedownindex.org/takedowns/boystown-csam-platform-takedown) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)