Recently, Operation Endgame, a collaboration between the U.S. Department of Justice and international partners, dismantled DanaBot’s malware network. Authorities exploited operators’ mistakes such as reused infrastructure and leaked logs to seize proxy servers, disable the loader mechanism and shut down affiliate portals, cutting off module deployment and data exfiltration. The takedown halted a platform responsible for extensive credential theft, session hijacking and covert surveillance —demonstrating how joint operations can effectively dismantle cybercriminal infrastructure.

In a landmark global operation, Microsoft, in collaboration with international law enforcement agencies including the U.S. Department of Justice and Europol, has dismantled the infrastructure behind Lumma Stealer—a notorious Malware-as-a-Service (MaaS) platform linked to widespread credential theft, financial fraud, and ransomware attacks. Lumma infected nearly 400,000 Windows devices worldwide and served hundreds of cybercriminals, including prominent ransomware groups like Octo Tempest. The coordinated takedown led to the seizure of over 2,300 malicious domains, with more than 1,300 redirected to Microsoft-controlled sinkholes to disrupt the malware’s operations and support further investigations. Marketed on underground forums since 2022, Lumma offered plug-and-play tools for stealing passwords, credit card data, and crypto wallets, making it popular for its low cost and adaptability. The operation delivers a major blow to the ecosystem supporting credential theft and ransomware, showing how coordinated action can significantly disrupt cybercriminal infrastructure.