Over the last three days, three major malware strains have been taken down in a large-scale law enforcement operation called Operation Endgame 3.0.
The ongoing initiative was coordinated by Europol and spanned 11 countries including law enforcement agencies from six EU countries, Australia, Canada, the UK and the US, and over 30 private partners from the cybersecurity industry.
Impacted infrastructure is linked to notorious infostealer Rhadamanthys, a remote access trojan called VenomRAT, and the Elysium botnet.
The mission also resulted in:
- Over 1025 servers taken down or disrupted
- 20 domains seized
- 11 locations searched
- The arrest of the suspected main operator of VenomRAT in Greece
Rhadamanthys infostealer “had grown to become one of the leading infostealers since Operation Endgame ‘Season 2’ disrupted the infostealer landscape,” according to a UK government-funded non-profit Shadowserver Foundation statement published on November 13.
This latest operation is the third series of takedowns of cybercrime-enabling infrastructure after Operation Endgame 1.0 (May 2024) and Operation Endgame 2.0 (April 2025).
Phil Wylie, Senior Consultant & Evangelist, Suzu had this to say:
“This operation shows what’s possible when intelligence and collaboration align, but dismantling one infrastructure doesn’t end the threat. Threat actors adapt fast, and defenders must be faster.
“To help reduce such risks, practicing good security hygiene is imperative, as well as proactive security measures including security assessments including penetration tests, and security controls validation.”
Michael Bell, Founder & CEO, Suzu:
“It’s true that it’s cat and mouse, but impact isn’t measured by permanence. Impact is measured by disruption cost and defender advantage gained.
“Operation Endgame 3.0 is forcing adversaries to rebuild 1,025 servers and reconstitute infrastructure across three major malware families (Rhadamanthys, VenomRAT, Elysium) means they’re investing resources in recovery instead of new attacks, and every credential rotation or system hardening that happens during this window reduces future attack surface.
“The arrest of VenomRAT’s main operator and seizure of databases containing millions of stolen credentials also creates operational security paranoia within cybercrime networks because when your infrastructure gets seized, you don’t know what intelligence law enforcement now has about your customers, affiliates, and future plans.
“So yes, they’ll rebuild, but these operations buy defenders time, degrade adversary confidence, and validate the public-private collaboration model that’s the only way to sustainably disrupt the cybercrime ecosystem.”
John Carberry, CMO, Xcape, Inc.:
“Reports indicate that criminals are now locked out of Rhadamanthys control panels, causing significant operational challenges for those involved. Security teams should now scan endpoints for remaining threats, change tokens and credentials across their systems, and integrate new indicators of compromise (IOCs) from the takedown to identify any lingering infections. Expect subsequent phishing campaigns and criminals’ attempts to rebuild infrastructure as they adapt and try new methods.
“The only way to win the cyberwar is to persistently decapitate the criminal infrastructure that runs the world’s malware economy.”
I welcome this news as the only way to beat cybercriminals is to make the cost of operation so high and so difficult that they abandon ransomware as a means to make money. This is a step towards that goal. But only a step as more needs to be done.
CISA warning: Patch actively exploited Cisco flaws ASAP
Posted in Commentary with tags CISA on November 13, 2025 by itnerdThe CISA issued an urgent warning that federal agencies must immediately patch two actively exploited Cisco ASA and Firepower vulnerabilities, CVE-2025-20362 and CVE-2025-20333. The flaws allow unauthenticated access to restricted endpoints and remote code execution, and when chained, give attackers full control of affected devices. Although Cisco patched the bugs in September after observing zero-day exploitation tied to the ArcaneDoor campaign, after many agencies incorrectly believed they had updated to safe versions.
Gunter Ollmann, CTO, Cobalt had this to say:
“The ongoing exploitation of these Cisco flaws highlights how attackers increasingly rely on chaining weaknesses to gain rapid, unauthenticated control over perimeter devices. These types of edge-network compromises are particularly attractive because they create a launch point that bypasses many downstream defenses. The challenge is that organizations still struggle to validate their exposure in real-world terms, even when patches exist. Offensive testing helps reveal whether the environment behaves as expected after updates and whether an attacker could still traverse overlooked paths. Mature programs treat patching as the starting point, not the finish line, and use adversarial validation to catch residual gaps before threat actors do.”
Wade Ellery, Chief Evangelist and IAM Strategy Officer, Radiant Logic follows with this:
“When firewalls or VPN gateways are compromised, attackers often pivot quickly into identity systems because credentials remain one of the most reliable pathways to deeper access. Incidents like this reveal how perimeter flaws can cascade into identity-based risks when agencies lack unified visibility across accounts, entitlements, and authentication patterns. The limitation is that many organizations still operate with fragmented identity data, making it hard to detect suspicious changes that follow network intrusions. Strengthening identity observability provides the context needed to spot anomalies early and contain lateral movement before privileges accumulate. Agencies that unify and observe identity data will be better positioned to absorb these infrastructure-level shocks and maintain Zero Trust resilience.”
Once again it’s time to patch all the things because of an actively exploited threat. The “fun” never ends in this business.
Leave a comment »