Summary
- Eurojust says 326 servers and 142 domains were neutralised during the latest Operation Endgame action week.
- The operation targeted SocGholish, StealC, and Amadey, which support initial access, credential theft, malware loading, and ransomware enablement.
- UK and European involvement gives the operation clear law-enforcement, identity, ransomware, and supply chain relevance.
Eurojust says an international law-enforcement coalition has disrupted infrastructure linked to three malware services used to support initial access, credential theft, and follow-on criminal activity.
The action, carried out under Operation Endgame, targeted SocGholish, StealC, and Amadey during a coordinated action week between 15 and 19 June. Eurojust said 326 servers and 142 domains were neutralised, while 27 million compromised datasets were recovered. Authorities from Germany, Belgium, Denmark, France, the Netherlands, the United Kingdom, the United States, and Canada took part, alongside Europol and Eurojust.
Rather than focusing on one ransomware group or a single intrusion, the operation was aimed at the technical services that feed wider criminal activity. SocGholish is used to distribute fake browser updates through compromised websites, creating access that can later be exploited for malware delivery or ransomware deployment. StealC is designed to extract passwords and digital identity material from infected systems. Amadey, a long-running malware loader, is commonly used to retrieve sensitive data or introduce additional malware after an initial compromise.
Eurojust has published a notice on the latest Operation Endgame action, setting out the law-enforcement participants and the broad technical scope of the disruption.
The recovered datasets are one of the most consequential parts of the operation. Infostealer infections have become a central enterprise risk because stolen credentials can be reused across corporate VPNs, cloud consoles, software repositories, collaboration platforms, and privileged administrative tools. In many incidents, the most damaging activity begins after an apparently routine credential theft event has already placed valid access in criminal marketplaces.
Stolen credentials also outlast the endpoint infection that produced them. A device may be cleaned, rebuilt, or replaced while session cookies, browser-saved passwords, SSH keys, developer tokens, and cloud credentials remain useful elsewhere. The recovery of 27 million compromised datasets therefore creates practical work for defenders: notification, password reset discipline, session revocation, token rotation, and checks for access reuse across corporate systems.
The law-enforcement approach reflects the industrial structure of modern cybercrime. Ransomware operators, access brokers, stealer developers, loaders, hosting providers, and money-laundering networks often overlap, but they do not always sit inside one identifiable group. Disrupting the infrastructure beneath those activities can raise costs and expose operators even when individual criminal brands reappear.
That does not make takedowns a complete answer. Malware services can rebuild domains, shift hosting, change branding, or use existing customer relationships to reconstitute operations. The value of Operation Endgame will depend on whether the recovered data supports further victim notification, arrests, infrastructure mapping, and asset seizures.
For organisations exposed through stolen identity material, the operational response cannot end with malware removal. Identity systems, session management, privileged access, and supplier connections need to be reviewed on the assumption that valid access may have left the organisation before the infection was detected. The visible law-enforcement action reduces one part of the criminal ecosystem; the residual enterprise exposure sits in credentials, tokens, and trusted access that may already be circulating.
