Takedown Index

53 booter and stresser domains · DDoS for hire

Lead

Not established

Result

53 domains seized; more than three million criminal accounts exposed; more than 75,000 warning messages sent to users.

Accountability

4 apprehended

Return status

Not established in the public record

Rhadamanthys, VenomRAT, Elysium botnet · Multi threat campaign

Lead

Not established

Result

1,025 servers taken down or disrupted; 20 domains seized; one VenomRAT suspect arrested in Greece on 2025-11-03.

Accountability

1 apprehended

Return status

Not established in the public record

DanaBot, Bumblebee, Lactrodectus, Qakbot, HijackLoader, Trickbot, Warmcookie · Multi threat campaign

Lead

BKA

Result

Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave.

Accountability

9 charged and 1 publicly wanted

Return status

Not established in the public record

IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, Trickbot · Multi threat campaign

Lead

French Gendarmerie, BKA, Dutch National Police

Result

More than 100 servers disrupted or taken down; more than 2,000 domains brought under law-enforcement control; 16 location searches.

Accountability

8 charged, 4 apprehended, and 8 publicly wanted

Return status

Not established in the public record

BreachForums (reconstituted) · Fraud and stolen data

Lead

FBI

Result

Clearnet domain seized and redirected to a seizure notice; associated Telegram infrastructure disrupted. Operators briefly regained the domain via registrar transfer credentials before losing it again.

Accountability

No individual outcomes recorded

Return status

Returned with some of the same operators

LockBit · Ransomware

Lead

NCA, FBI

Result

34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.

Accountability

4 charged, 3 apprehended, 2 convicted, and 3 publicly wanted

Return status

Returned under the same operators

Qakbot · Malware and botnets

Lead

FBI

Result

Botnet traffic redirected to FBI infrastructure; uninstaller delivered to approximately 700,000 infected computers; 52 servers seized; approximately 8.6 million USD in cryptocurrency seized.

Accountability

No individual outcomes recorded

Return status

Returned under the same operators

Snake malware network · State sponsored

Lead

FBI

Result

Snake implants on victim machines disabled by issuing commands that caused the malware to overwrite its own vital components; peer-to-peer network neutralized.

Accountability

No individual outcomes recorded

Return status

Later activity recorded, link to the original not established

Genesis Market · Fraud and stolen data

Lead

FBI, Dutch National Police

Result

Eleven domains seized under a US warrant; US-based servers seized; marketplace clearnet access replaced with seizure notice.

Accountability

119 apprehended

Return status

Not established in the public record

48 booter and stresser services · DDoS for hire

Lead

FBI

Result

48 domains seized and redirected to seizure notices.

Accountability

6 charged

Return status

Not established in the public record

RaidForums · Fraud and stolen data

Lead

FBI

Result

Domains raidforums.com, rf.ws, and raid.lol seized and redirected to a seizure notice; forum infrastructure taken offline.

Accountability

1 charged and 1 apprehended

Return status

Followed by a successor service

Emotet · Malware and botnets

Lead

Dutch National Police, BKA

Result

Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.

Accountability

2 apprehended

Return status

Returned on replacement infrastructure

EncroChat · Criminal communications

Lead

French Gendarmerie, Dutch National Police

Result

Server infrastructure in France compromised by a law-enforcement implant; more than 100 million messages intercepted; network shut down and users warned by the operator.

Accountability

No individual outcomes recorded

Return status

Later activity recorded, link to the original not established

Webstresser.org · DDoS for hire

Lead

Dutch National Police, NCA

Result

Service infrastructure seized in the Netherlands, the United States, and Germany; domain taken offline and replaced with a seizure notice.

Accountability

6 apprehended

Return status

Followed by a successor service

Welcome to Video · Child sexual abuse material

Lead

IRS-CI, HSI

Result

Server seized in South Korea and site taken offline; approximately eight terabytes of material and roughly 250,000 videos secured; Bitcoin transaction analysis used to identify users.

Accountability

1 charged, 1 apprehended, and 1 convicted

Return status

Later activity recorded, link to the original not established

Silk Road 2.0 and additional Tor marketplaces · Darknet market

Lead

FBI

Result

Silk Road 2.0 hidden service seized; dozens of additional onion services seized or disabled; servers seized across multiple countries.

Accountability

1 charged and 1 apprehended

Return status

Not established in the public record

Gameover Zeus botnet and CryptoLocker ransomware · Malware and botnets

Lead

FBI, NCA

Result

Peer-to-peer and DGA command-and-control infrastructure seized and sinkholed; infected machines redirected to law-enforcement-controlled servers; CryptoLocker key server infrastructure disrupted.

Accountability

1 charged and 1 publicly wanted

Return status

Returned on replacement infrastructure