Do Son 
Police operations targeting cybercriminals and dark market traders are gaining unprecedented momentum. Two major international campaigns—Operation Endgame and Operation RapTor—have yielded substantial results in dismantling the infrastructure behind malware distribution, ransomware attacks, and illicit commerce within the dark web.
Launched in May 2024, Operation Endgame is focused on dismantling services that provide initial access vectors for subsequent ransomware campaigns. This time, coordinated law enforcement actions resulted in the takedown of approximately 300 servers across the globe, the neutralization of 650 domain names, and the issuance of arrest warrants for 20 individuals linked to access provisioning for threat actor groups.
The operation concentrated on emerging variants of malware and the successors of previously dismantled groups. Among the primary targets were Bumblebee, Lactrodectus, QakBot, HijackLoader, DanaBot, TrickBot, and WARMCOOKIE. The operation’s active phase spanned from May 19 to May 22, 2025.
Beyond its technical achievements, the operation also led to the seizure of cryptocurrency valued at €3.5 million, raising the total amount of confiscated digital assets under Operation Endgame to €21.2 million. Europol emphasized that such malware is often sold as a service to other malicious actors and used in large-scale attacks involving data encryption and extortion.
Simultaneously, Germany’s Federal Criminal Police Office initiated criminal proceedings against 37 suspects, including members of notorious cybercrime syndicates such as QakBot and TrickBot. Among the individuals now officially listed as Europe’s most wanted are Roman Mikhailovich Prokop (carterj), Danil Raisovich Khalitov (dancho), Iskander Rifkatovich Sharafetdinov (alik, gucci), Mikhail Mikhailovich Tsaryov (mango), Maksim Sergeyevich Galochkin (bentley, Max17, crypt), and Vitaly Nikolaevich Kovalev (stern, Grave, Vincent, Bentley, Bergen, Alex Konor).
The second front in this international crackdown unfolded within the underworld of dark web marketplaces under the banner of Operation RapTor. Europol and national enforcement agencies succeeded in identifying and arresting 270 individuals involved in illicit trade—both sellers and buyers. The countries leading in arrest numbers were the United States, Germany, the United Kingdom, and France. Seized assets included €184 million in cash and cryptocurrency, two tons of narcotics, 180 firearms, over 12,000 counterfeit goods, and four tons of illegal tobacco.
Analysts note that the operation was built upon intelligence gathered following the takedown of prominent darknet platforms, including Nemesis, Tor2Door, Bohemia, and Kingdom Markets. Many suspects are connected to thousands of illegal transactions and frequently employed cryptocurrency and encryption tools to maintain anonymity.
Europol highlights that under mounting police pressure, traditional darknet marketplaces are retreating into deeper obscurity, giving way to decentralized, vendor-operated sites designed to reduce risk and circumvent platform fees. Yet, despite persistent law enforcement efforts, narcotics remain the dominant commodity traded on the dark web.
Participants in the operation underscore a critical message: criminals can no longer cling to the illusion of impunity. The sweeping arrests and asset seizures affirm that even the perceived anonymity of the dark web no longer offers true protection.
Donate