Microsoft, Europol and Germany's BKA dismantled over 200 command-and-control servers, cutting criminal access to more than 18,000 identified infected machines. AI-driven analysis revealed that Amadey and StealC—although created by different actors—shared infrastructure, enabling Microsoft to use the US RICO statute to treat the operations as a single global conspiracy. The effort, part of the broader Operation Endgame, involved multinational police cooperation and led to server seizures, millions of previously freed PCs and international arrest warrants.
200+ Cybercrime Servers Dismantled: AI and RICO Help Disrupt Global Amadey–StealC Network
FILE PHOTO - A person types with gloved hands on an illuminated laptop keyboard. (is associated with: «Microsoft, Germany's BKA and Europol take down 200 cybercrime servers») Philip Dulian/dpa
Investigators from Microsoft, Europol and Germany's Federal Criminal Police Office (BKA) have dismantled more than 200 command-and-control servers used by organized cybercriminals, severing criminal control over 18,000+ identified victim machines worldwide.
What Happened
The operation targeted two of the most widely distributed malware families: Amadey (a loader) and StealC (a data-stealing payload). Using a novel mix of technical analysis and legal strategy, authorities disrupted the infrastructure that allowed attackers to remotely manage and exploit infected systems.
How AI Accelerated the Takedown
Investigators used artificial intelligence to analyse complex malware code in minutes rather than days, quickly revealing that Amadey and StealC—although developed by different criminal actors—relied on common servers and shared technical infrastructure. That rapid code analysis was key to mapping the network and coordinating an international response.
Legal Strategy: RICO Applied
Armed with the AI-assisted technical link, Microsoft's legal team invoked the US Racketeer Influenced and Corrupt Organizations Act (RICO) to treat the separate malware campaigns as part of a single global conspiracy. Applying RICO allowed authorities to pursue the broader criminal network in one coordinated action rather than addressing each malware family in isolation.
Scope and Impact
In the first half of May alone, Amadey and StealC were associated with more than 140,000 infections worldwide; Germany was the second-most affected country in that sample after the United States. The fallout from these campaigns can be severe—ranging from disrupted hospitals to activity linked to state-sponsored espionage. Authorities highlighted cases in which the Russia-linked group known as Secret Blizzard exploited Amadey infections to target systems in Ukraine.
International Cooperation: Operation Endgame
The takedown benefited from close international police cooperation. While Microsoft focused on Amadey, Europol's European Cybercrime Centre (EC3) investigated StealC, and the BKA coordinated with Dutch and Danish police. Part of a broader multinational effort dubbed "Operation Endgame," the campaign in May 2024 dismantled the infrastructure of several dangerous botnet loaders and, under Europol and BKA leadership, led to the seizure of hundreds of servers, the liberation of millions of infected PCs in prior actions, and the issuance of international arrest warrants.
Why This Matters
This operation demonstrates how combining AI-enabled technical analysis with targeted legal tools and international policing can disrupt complex cybercrime ecosystems more efficiently. It also underscores the continuing threat posed by modular malware ecosystems in which different criminal groups specialise in intrusion, credential theft and monetisation.
What To Watch Next: Authorities may follow up with prosecutions based on international arrest warrants, and defenders should prioritise blocking known Amadey/StealC indicators, applying patches, and credential hygiene to limit future spread.
Help us improve.
