Recent cybercrime countermeasures and implications for corporate security

On one side, criminals, increasingly aided by AI.
On the other, international law enforcement agencies, more united and specialised than ever.
At the centre, the digital and economic assets of companies and individuals: billions of stolen passwords, millions of systems breached and exploited at will by criminals.

As part of our ongoing commitment to raising awareness on cybersecurity, we draw your attention to the results of “Operation Endgame”, an international initiative to fight cybercrime, coordinated by Europol.

Operation Endgame was launched in 2024 by a task force comprising Europol, private technology companies, and six European states, joined by the USA, Canada, and Australia. Its goal is to dismantle the activities of cybercriminal organisations by shutting down their infrastructures and seizing the data they have stolen.

In this video published on Engage, a brief overview of the main results achieved by Europol in recent years, before and after the launch of Operation Endgame.

The most recent phase of the operation, called “End of the game for cybercrime infrastructure”, took place from 10 to 13 November 2025 and resulted in the dismantling of a large criminal infrastructure. Law enforcement neutralised 1,025 servers supporting three major international cybercrime enablers:

• Rhadamanthys: a massive infostealer (information-stealing software)
• VenomRAT: a Remote Access Trojan (RAT)
• Elysium: a botnet.

The main suspect linked to VenomRAT was arrested in Greece on 3 November 2025. Other individuals under investigation have been identified as part of the “EU Most Wanted” list.

Impact and relevance for our security

The dismantled infrastructure was responsible for infecting systems of hundreds of thousands of victims worldwide, many of whom were unaware. The stolen data included millions of compromised credentials and over 100,000 cryptocurrency wallets, with a potential value of millions of euros.

The cause of these infections was always the same: execution of malicious software originating from untrusted websites or media.

How to prevent these attacks

By following the recommendations outlined in company policies and frequent communications, in particular:

• Install software only from official sources and with prior authorisation
• Store passwords and other credentials/secrets in the official Engineering Group Password Manager (see Engage)
• Do not use company PCs and accounts for non-work-related activities
• Keep installed software up to date.

For more details on these and other important measures, visit this page on Engage.

AI-driven attacks: when the hacker is an algorithm

Despite the dismantling of major malicious actors, criminal organisations continue to grow and evolve, thanks to the widespread adoption of artificial intelligence.

Recently, the first large-scale attack carried out almost entirely through AI has been made public (news from Anthropic and Euronews): a spying campaign discovered and blocked by Anthropic – creator of the AI “Claude” – which used autonomous AI agents to infiltrate around thirty global targets, including tech companies, financial institutions, and government agencies.
The criminal group, believed to be state-sponsored by China, used the Claude Code tool to manage all phases of the offensive: reconnaissance, credential theft, and data exfiltration.

This operation marks a turning point: AI is no longer just a support tool, but a direct actor, capable of making attacks faster, more scalable, and harder to detect.

Anthropic warns that such threats will grow in complexity and effectiveness, making it even more essential for companies and individuals to adopt all preventive measures and remain vigilant to keep their resources safe.

Thanks for your collaboration
Best regards
Group Information Security Office