{"id":59675,"date":"2025-11-13T12:01:30","date_gmt":"2025-11-13T12:01:30","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/rhadamanthys-malware-admin-rattled-as-cops-seize-a-thousand-plus-servers\/"},"modified":"2025-11-13T12:01:30","modified_gmt":"2025-11-13T12:01:30","slug":"rhadamanthys-malware-admin-rattled-as-cops-seize-a-thousand-plus-servers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/rhadamanthys-malware-admin-rattled-as-cops-seize-a-thousand-plus-servers\/","title":{"rendered":"Rhadamanthys malware admin rattled as cops seize a thousand-plus servers"},"content":{"rendered":"

International cops have pulled apart the Rhadamanthys infostealer operation, seizing 1,025 servers tied to the malware in coordinated raids between November 10-13.<\/p>\n

The infrastructure takedown, part of the long-running Operation Endgame coordinated by Europol and Eurojust, affected hundreds of thousands of infected computers containing several million stolen credentials worldwide.<\/p>\n

<\/p>\n

Europol: Five pay-per-infect suspects cuffed, some spill secrets to cops<\/h2>\n

READ MORE<\/span><\/a><\/div>\n

“Many of the victims were not aware of the infection of their systems,” the operation saidd<\/p>\n

Today’s announcement confirms recent reports<\/a> of a Rhadamanthys takedown after cybercrime forums reported European law enforcement had seized its infrastructure.<\/p>\n

The malware’s administrator told customers to down tools “for safety reasons” on November 11, hours before the operation’s onion site went dark.<\/p>\n