OPERATION ENDGAME PART 3
On November 13th 2025, The Dutch National Police, in cooperation with EuropPol and Eurojust announced they took down botnets in a another episode of Operation Endgame, the biggest continued anti-botnet operation to date. During this takedown, stolen data has been seized.
As part of this operation, stealer logs containing information on many victims of the targeted malware platforms have been shared with: DIVD, Have I Been Pwned, Spamhaus, Project No More Leaks, Project Check je Hack, the (Dutch) NCSC, CSIRT-DSP, and Digital Trust Center.
NCSC, DTC and DIVD are working together to notify victims in the datasets. To support this process, the data has been shared with parties such as Check Je Hack, Have I Been Pwned, No More Leaks, the (Dutch) NCSC, CSIRT-DSP and Digital Trust Center.
The datasets we received consist of usernames, (redacted) passwords, and the dates these passwords were last used. It is likely that this information was taken from the built-in password managers of popular web browsers.
Recommendation
If you received a notification from us, you, members of your organization or your customers had their password stolen or system infected by the Rhadamanthys infostealer. Detailed recommendations can be found in our CSIRT Casefile: https://csirt.divd.nl/cases/DIVD-2025-00041/
What you should do
Since the datasets contain data of too many individuals, we will not be sending out individual notifications. Instead we are enabling certs, csirts and security teams to check of data of their users is present in the datasets we received and, if present, to request the details. We have outlined the full procedure on our credentials page.
If you want to find out if your organisation was impacted, you can find out as follows:
- Download the Endgame 2025q4 datasets: Batch 1: Rhadamanthys - 13-11-2025
- Open the files (watch out Excel truncates them due to their size) and look for domains you are responsible for.
- If your domains appear in the dataset, email divd-2025-00041@csirt.divd.nl to request the corresponding data.
Please note: we will validate your claim and only send you data if your country has a sufficiently high score on the human rights index.
What we are doing
As we receive more information, we will analyse them and publish more apex sets. Make sure you keep an eye on the case, because it will be updated.