Takedown Index

53 booter and stresser domains · DDoS for hire

Lead

Not established

Result

53 domains seized; more than three million criminal accounts exposed; more than 75,000 warning messages sent to users.

Accountability

4 apprehended

Return status

Not established in the public record

Rhadamanthys, VenomRAT, Elysium botnet · Multi threat campaign

Lead

Not established

Result

More than 1,000 servers disrupted; approximately 20 domains seized; access to several hundred thousand infected machines removed from operators.

Accountability

1 apprehended

Return status

Not established in the public record

Archetyp Market · Darknet market

Lead

BKA

Result

Server infrastructure seized by Dutch police; marketplace taken offline and replaced with seizure notice; approximately 7.8 million EUR in assets seized.

Accountability

8 apprehended

Return status

Later activity recorded, link to the original not established

DanaBot, Bumblebee, Lactrodectus, Qakbot, HijackLoader, Trickbot, Warmcookie · Multi threat campaign

Lead

BKA

Result

Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave.

Accountability

3 charged and 1 publicly wanted

Return status

Not established in the public record

Lumma Stealer · Malware and botnets

Lead

Microsoft DCU and DOJ

Result

Approximately 2,300 malicious domains seized or redirected to Microsoft sinkholes; DOJ seized the central command structure and marketplaces selling the malware; European and Japanese infrastructure suspended.

Accountability

No individual outcomes recorded

Return status

Returned under the same operators

BreachForums (further reconstituted) · Fraud and stolen data

Lead

Not established

Result

Portal infrastructure seized and replaced with a law-enforcement notice.

Accountability

No individual outcomes recorded

Return status

Not established in the public record

27 booter and stresser platforms · DDoS for hire

Lead

Not established

Result

27 platforms taken offline and domains seized.

Accountability

3 apprehended

Return status

Not established in the public record

Raptor Train · State sponsored

Lead

FBI

Result

Control of the botnet infrastructure seized; malware disabled on compromised devices; operators' attempt to migrate the botnet was countered.

Accountability

No individual outcomes recorded

Return status

Not established in the public record

IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, Trickbot · Multi threat campaign

Lead

French Gendarmerie, BKA, and Dutch National Police

Result

More than 100 servers disrupted or taken down; more than 2,000 domains brought under law-enforcement control; 16 location searches.

Accountability

8 charged, 4 apprehended, and 8 publicly wanted

Return status

Not established in the public record

911 S5 · Malware and botnets

Lead

FBI

Result

23 domains and more than 70 servers seized; botnet infrastructure dismantled; approximately 30 million USD in assets seized or restrained.

Accountability

1 charged and 1 apprehended

Return status

Not established in the public record

BreachForums (reconstituted) · Fraud and stolen data

Lead

FBI

Result

Clearnet domain seized and redirected to a seizure notice; associated Telegram infrastructure disrupted. Operators briefly regained the domain via registrar transfer credentials before losing it again.

Accountability

No individual outcomes recorded

Return status

Returned with some of the same operators

LockBit · Ransomware

Lead

NCA and FBI

Result

34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.

Accountability

4 charged, 3 apprehended, 2 convicted, and 3 publicly wanted

Return status

Returned under the same operators

KV Botnet · State sponsored

Lead

FBI

Result

Malware deleted from compromised routers; command-and-control connections severed; steps taken to prevent reinfection without affecting legitimate router functions.

Accountability

No individual outcomes recorded

Return status

Not established in the public record

Qakbot · Malware and botnets

Lead

FBI

Result

Botnet traffic redirected to FBI infrastructure; uninstaller delivered to approximately 700,000 infected computers; 52 servers seized; approximately 8.6 million USD in cryptocurrency seized.

Accountability

No individual outcomes recorded

Return status

Returned under the same operators

Snake malware network · State sponsored

Lead

FBI

Result

Snake implants on victim machines disabled by issuing commands that caused the malware to overwrite its own vital components; peer-to-peer network neutralized.

Accountability

No individual outcomes recorded

Return status

Later activity recorded, link to the original not established

Genesis Market · Fraud and stolen data

Lead

FBI and Dutch National Police

Result

Eleven domains seized under a US warrant; US-based servers seized; marketplace clearnet access replaced with seizure notice.

Accountability

119 apprehended

Return status

Not established in the public record

BreachForums · Fraud and stolen data

Lead

FBI

Result

Forum taken offline by a remaining staff member citing law-enforcement access to infrastructure; administrator's devices and accounts seized.

Accountability

1 charged, 1 apprehended, and 1 convicted

Return status

Returned with some of the same operators

48 booter and stresser services · DDoS for hire

Lead

FBI

Result

48 domains seized and redirected to seizure notices.

Accountability

6 charged

Return status

Not established in the public record

Hive · Ransomware

Lead

FBI

Result

Covert access to the Hive network for approximately seven months; more than 300 decryption keys provided to victims under active attack and more than 1,000 additional keys distributed to previous victims; leak site and payment site seized; servers seized in Germany and the Netherlands.

Accountability

No individual outcomes recorded

Return status

Returned under a new name

RaidForums · Fraud and stolen data

Lead

FBI

Result

Domains raidforums.com, rf.ws, and raid.lol seized and redirected to a seizure notice; forum infrastructure taken offline.

Accountability

1 charged and 1 apprehended

Return status

Followed by a successor service

Hydra Market · Darknet market

Lead

BKA

Result

Server infrastructure in Germany seized; approximately 543.3 BTC seized in 88 transactions; marketplace taken offline.

Accountability

1 charged and 1 publicly wanted

Return status

Followed by a successor service

Sky ECC · Criminal communications

Lead

Belgian Federal Police and Dutch National Police

Result

Encrypted traffic decrypted and monitored; infrastructure disrupted; large-scale searches and seizures on the action day.

Accountability

48 apprehended

Return status

Not established in the public record

NetWalker · Ransomware

Lead

FBI

Result

Dark-web victim communication and leak resources seized and taken offline; approximately 454,530 USD in cryptocurrency seized.

Accountability

1 charged

Return status

Not established in the public record

Emotet · Malware and botnets

Lead

Dutch National Police and BKA

Result

Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.

Accountability

2 apprehended

Return status

Returned on replacement infrastructure

ANOM · Criminal communications

Lead

FBI and AFP

Result

Law enforcement operated the platform itself from inception; more than 27 million messages collected from roughly 12,000 devices across more than 300 criminal syndicates; network shut down at the action week.

Accountability

9 charged

Return status

Later activity recorded, link to the original not established