Rhadamanthys Infostealer Infrastructure Disrupted in Apparent Law Enforcement Takedown

Summarize with:

ChatGPT Claude.ai Google AI Grok Perplexity

Add as preferred source on Google

Key Takeaways

• Infrastructure offline: The infrastructure supporting the Rhadamanthys Infostealer, including its official TOR website, has been rendered inaccessible.
• Law enforcement: Internal communications among threat actors warn of EU police activity.
• Connections: The disruption is reportedly linked to a coordinated law enforcement crackdown on cybercrime.

The Rhadamanthys infostealer operation has suffered a significant blow, with its core infrastructure, including its TOR-based website, becoming unreachable. This disruption has triggered widespread concern among its user base, with internal communications revealing urgent warnings about a law enforcement operation. 

Cybercrime Infrastructure Disruption

A message circulated among Rhadamanthys operators, attributed to a user named "rhad," advised an immediate cessation of activities, citing actions by EU police, according to Hudson Rock’s co-founder & CTO Alon Gal.

The alert detailed evidence of compromise, including server logins from German IPs and changes to SSH login methods, prompting calls to reinstall systems and erase traces.

The takedown appears to be part of a coordinated effort targeting major cybercrime services. The internal messages specifically note that multiple machines in EU data centers have been affected and that the group's TOR website has been blocked. 

This level of cybercrime infrastructure disruption points to a sophisticated and well-executed campaign by international law enforcement agencies. 

The panicked reaction from the malware’s affiliates underscores the effectiveness of the operation, which has seemingly dismantled key components of the Rhadamanthys infostealer network, leaving its operators unable to log in or manage their activities.

Potential Link to Operation Endgame

Evidence suggests the action against Rhadamanthys is connected to the ongoing Operation Endgame, a major international initiative targeting malware droppers and botnets. 

An Operation Endgame update on its official website appears to coincide with the Rhadamanthys takedown, indicating this may be the latest phase of the global crackdown. We’ll update this story after the countdown ends.

This potential link situates the disruption within a broader strategic effort to dismantle the cybercrime ecosystem by targeting not just the malware itself but also the foundational infrastructure that supports its distribution and control.

The DanaBot malware recently resurfaced despite being dismantled via Operation Endgame about six months ago.

In August, a BlackSuit Ransomware takedown disabled nine domains and four servers, seizing $1 million, while Meduza Infostealer developers were arrested in a Russian authorities’ crackdown in October.

Related

Suspicious Temu Support Accounts on X Raise Phishing Concerns: Unofficial Accounts Under Scrutiny

Two-Thirds of Top AI 50 Companies Leaked Sensitive Data on GitHub, Including API Keys and Tokens

LLM Side-Channel Attack ‘Whisper Leak’ Exposes Encrypted Communications

DanaBot Banking Trojan Resurfaces with Version 669 After Operation Endgame Takedown, Focused on Cryptocurrency Theft

Triofox Unauthenticated Access Flaw, Chained with AV Scanning Feature Abuse to Deploy Remote Access Tools

xHunt APT Group Spies on Kuwait, Leveraging Microsoft Exchange, IIS, and Custom Backdoors

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.

Subscribe for Free

Please enter a valid email address.

Most Popular

Suspicious Temu Support Accounts on X Raise Phishing Concerns: Unofficial Accounts Under Scrutiny

Italy Enforces Online Age Checks from November 12 – What It Means for VPN Users

Why Microsoft Copilot May Be Your Most Risky Insider Threat

Two-Thirds of Top AI 50 Companies Leaked Sensitive Data on GitHub, Including API Keys and Tokens

LLM Side-Channel Attack ‘Whisper Leak’ Exposes Encrypted Communications

DanaBot Banking Trojan Resurfaces with Version 669 After Operation Endgame Takedown, Focused on Cryptocurrency Theft

Suspicious Temu Support Accounts on X Raise Phishing Concerns: Unofficial Accounts Under Scrutiny

Italy Enforces Online Age Checks from November 12 – What It Means for VPN Users

Why Microsoft Copilot May Be Your Most Risky Insider Threat

Two-Thirds of Top AI 50 Companies Leaked Sensitive Data on GitHub, Including API Keys and Tokens

LLM Side-Channel Attack ‘Whisper Leak’ Exposes Encrypted Communications

DanaBot Banking Trojan Resurfaces with Version 669 After Operation Endgame Takedown, Focused on Cryptocurrency Theft