Joint Action Against Cybercriminals: BKA, Europol and Microsoft Dismantle Malware Infrastructure

At the center of this operation were the two most widely used malicious programs worldwide, Amadey and StealC. The investigators discovered that although the two malicious programs were developed by different criminals, they relied on the same technical infrastructure. Amadey breaks into systems, while StealC steals passwords and sensitive data – a classic division of labor in the digital underworld.

International Cooperation

In the first half of May alone, these tools were involved in more than 140,000 infections worldwide. Germany was the second most affected country in this sample, behind the United States. To understand how the malware worked, the investigators used artificial intelligence, which enabled them to analyze the complex code in minutes rather than days.

The German-Dutch-Danish cooperation formed the backbone of the operation. The German Federal Criminal Police Office played an important role: together with Dutch and Danish police authorities, the German officers took action against the criminal infrastructure as part of the international "Operation Endgame." Under the leadership of Europol and the BKA, hundreds of servers were seized, millions of infected PCs freed, and international arrest warrants issued against the ringleaders.

Legal Tools Against Global Networks

The operational results are considerable: around 15,000 websites, more than 320 servers, and over 140 domains were neutralized. Microsoft was able to shut down more than 200 command-and-control servers – the central systems that malicious hackers use to remotely control infected devices. At the same time, criminal control over more than 18,000 identified victim computers worldwide was severed.

Parallel to the technical dismantling, legal proceedings were underway. In Germany, investigations are being conducted, among other things, on suspicion of gang-related and commercial extortion, as well as extortion in particularly serious cases. According to media reports, the US law against organized crime was applied – the so-called RICO (Racketeer Influenced and Corrupt Organizations Act). This allows investigators to charge various actors as part of a single, global criminal conspiracy and thus attack the entire network at once.

Voices from the Investigative Authorities

While Microsoft was investigating the threat posed by Amadey, Europol's Cybercrime Centre (EC3) was simultaneously investigating the StealC program. This also includes attacks by the Russia-associated group "Secret Blizzard," which used Amadey infections for attacks on targets in Ukraine. The consequences of such attacks are far-reaching, ranging from paralyzed hospitals to state-sponsored espionage.

Carsten Meywirth, head of the Cybercrime division at the BKA, said: "Mit der Fortsetzung der Operation Endgame sind wir erneut gegen die technischen Infrastrukturen vorgegangen, auf die sich zahlreiche Cyberkriminelle weltweit verlassen haben." A BKA spokesperson added: "Die Maßnahmen nehmen den Tätern zentrale Werkzeuge aus der Hand, unterbrechen die virtuelle Infektionskette und schützen viele weitere potenzielle Opfer vor diesen Schadsoftware-Varianten."

The BKA spokesperson continued that the operation had weakened a significant building block of the criminal value creation process within the networked and specialized structures in the area of cybercrime. Meywirth also emphasized: "Das zeigt, dass die internationalen Strafverfolgungsbehörden Cybercrime grenzüberschreitend alle rechtlichen Mittel entgegensetzen, auch in enger Zusammenarbeit mit dem Privatsektor." "Operation Endgame" was the largest international police action against cybercrime to date, in which the infrastructure of the world's most dangerous botnet loaders – including Amadey – was dismantled in May 2024.

The action also had immediate effects on the capital market: Microsoft stock, listed on NASDAQ, temporarily gained 1.28 percent to $378.73. The report was broadcast on June 24, 2026, on the program Deutschlandfunk, dated from Redmond and Wiesbaden.