Operation Endgame: Law Enforcement Disrupts StealC and Amadey Malware, Freezes $47M in Crypto

Operation Endgame Strikes Again

Operation Endgame, the largest international law enforcement operation aimed at disrupting ransomware and cybercrime infrastructure, has claimed its latest targets: StealC and Amadey malware networks.

What Was Disrupted

Infrastructure Takedowns

The Malware Families

**StealC** — An information stealer that harvests credentials, cookies, and sensitive data from infected machines. Researchers found it downloading LockBit Black ransomware payloads.

**Amadey** — A botnet that distributes malware and maintains backdoor access to compromised systems.

Together, they were linked to **140,000+ infected computers** in the first two weeks of May 2026 alone.

The Operation

Partners Involved

Technical Approach

Researchers identified a vulnerability in the StealC C2 panel and built a bot emulator to simulate normal StealC infection activity. This allowed them to:

1. Extract configurations from StealC samples

2. Retrieve and analyze malicious payloads

3. Map the criminal infrastructure

4. Coordinate takedown activities

The SocGholish Connection

This follow-up action came after the disruption of SocGholish malware infrastructure on June 18, 2026. SocGholish was a major initial access broker that:

Stolen credentials from SocGholish have been added to Have I Been Pwned, allowing users to check if they were affected.

Why This Matters

1. Infostealers Lead to Ransomware

StealC was actively delivering LockBit Black ransomware. Stolen credentials are the first step in most ransomware attacks.

2. Crypto Seizures Hurt Criminals

Freezing $47 million in crypto assets directly impacts the financial incentives driving cybercrime.

3. International Cooperation Works

This operation involved agencies from multiple countries and private sector partners, showing that coordinated action can disrupt even large-scale operations.

What You Should Do

Check for Exposure

Protect Against Infostealers

Monitor Your Domain

Use Vaarta.space to scan for security issues that could make you a target.

[Free security scan](https://vaarta.space)