Summary:
In the latest spike of Operation Endgame, a global law enforcement action, law enforcement took down nearly 300 servers and 650 malicious domains that threat actors were utilizing to launch ransomware attacks. The operation, which was conducted from May 19–22, 2025, is a sustained effort since 2024 to thwart the early stages of ransomware campaigns by targeting the malware and those behind it.

In this recent takedown, law enforcement also seized €3.5 million in cryptocurrency, issued 20 arrest warrants, and identified 37 individuals who were associated with well-known cybercriminal groups like QakBot and TrickBot. These groups are notorious for selling access to networks, which ransomware gangs use to launch attacks on organizations worldwide.

In the meantime, Operation RapTor, another Europol-orchestrated operation, resulted in 270 arrests in 10 countries and considerable seizures of illegal items sold on the dark web, such as drugs, firearms, and counterfeit products.

Security Officer Comments:
This new wave of takedowns proves that cybercrooks can't hide forever, no matter if they're working in cyberspace or using tools like cryptocurrencies and encryption to cover their tracks. The actors behind ransomware aren't just hoodie-wearing hackers, they're organized and sophisticated, like cyber gangs, and a few are even on the EU's Most Wanted List. These moves prove that international cooperation is yielding dividends, and authorities are learning how to strike back by not just targeting the perpetrators, but the equipment and services they rely on to execute attacks.

Suggested Corrections:

• Keep software updated: Many attacks start by exploiting outdated systems.
• Use multi-factor authentication (MFA): This adds an extra layer of security, even if a password is stolen.
• Train staff to spot phishing: Most ransomware starts with someone clicking a bad link or attachment.
• Back up your data regularly: If you're attacked, backups can help you recover without paying ransom.
• Block known bad domains and IPs: Use threat intelligence and security tools to stop traffic to malicious servers.
• Limit access: Only give admin privileges to users who truly need them. Use role-based access control.
• Monitor for suspicious behavior: Keep an eye out for unexpected changes in network activity.

Link(s):
https://www.europol.europa.eu/media...again-ransomware-kill-chain-broken-its-source