Operation Endgame Disrupts Infrastructure Linked to Rhadamanthys, VenomRAT and Elysium
Summary
Team Cymru says its analysis helped identify Rhadamanthys infrastructure as Europol-coordinated Operation Endgame disrupted 1,025 servers, seized 20 domains and led to an arrest in Greece.
Key points
- The latest Operation Endgame phase, conducted November 10–13, targeted the infostealer Rhadamanthys, VenomRAT remote access Trojan and Elysium proxy botnet.
- The coordinated operation involved more than 30 public and private parties and disrupted or took down 1,025 malicious servers, seized 20 domains and included searches at 11 European locations.
- Authorities arrested in Greece the person described in the article as the main suspect behind VenomRAT.
- Team Cymru says analysts used netflow data and its Scout platform to identify Rhadamanthys backend and management infrastructure and investigate operator activity.
- The article says the disrupted infrastructure involved hundreds of thousands of infected machines and was responsible for stealing hundreds of thousands of credentials and compromising over 100,000 cryptocurrency wallets; the wallets were thought to contain millions of dollars.
Article Details
- Event Type
- International law enforcement takedown disrupting the infrastructure of the Rhadamanthys infostealer, VenomRAT remote access Trojan, and Elysium proxy botnet as part of Operation Endgame.
- Impact
- The coordinated action disrupted or took down 1,025 malicious servers, seized 20 domains, conducted searches at 11 locations in Europe, and resulted in the arrest in Greece of the main suspect behind VenomRAT. The dismantled infrastructure involved hundreds of thousands of infected machines globally. The malware was reported to have stolen hundreds of thousands of credentials and compromised more than 100,000 cryptocurrency wallets, thought to contain the equivalent of millions of dollars.
Malware
Danabotin Operation Endgame I and Operation Endgame II, helping to disrupt the versatile and persistent Trojan DanaBot Elysiumthe infrastructure of the infostealer Rhadamanthys, the remote access Trojan VenomRAT, and the botnet Elysium. Rhadamanthystools. The takedowns, part of Operation Endgame, disrupted the infrastructure of the infostealer Rhadamanthys, the remote access Trojan VenomRAT, and the botnet Elysium. VenomRATEndgame, disrupted the infrastructure of the infostealer Rhadamanthys, the remote access Trojan VenomRAT, and the botnet Elysium.