The most effective way to stop a ransomware attack isn't to chase the encryption payload at the finish line — it's to demolish the assembly line before the first component ever ships. That strategic logic drove one of the most ambitious coordinated cybercrime disruption operations in law enforcement history, as agencies across North America and Europe, backed by more than a dozen private sector partners, simultaneously dismantled the infrastructure behind three malware families that collectively serve as the engine room of the global cybercrime-as-a-service economy.
Striking at the Supply Chain's Foundation
The operation, executed across a concentrated operational window in mid-June 2026, targeted three malware families — SocGholish, Amadey, and StealC — not because each is individually novel, but because together they form an interlocking attack chain that feeds virtually every downstream criminal operation. Participating agencies included law enforcement bodies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States, coordinated through Europol and Eurojust. Private partners including Microsoft, Bitdefender, Proofpoint, Infoblox, Shadowserver, and Orange Cyberdefense contributed intelligence and technical support throughout.
The operational results were substantial. Investigators actioned 326 servers and 142 domains, recovered 27 million stolen login credentials, and identified and restricted more than €41 million (approximately $47 million USD) in cryptocurrency assets of criminal origin. Nearly 15,000 compromised websites were remediated — the majority of them legitimate small businesses operating on WordPress, silently conscripted into malware distribution without their owners' knowledge.
Three Families, One Kill Chain
Understanding why these three specific families were targeted together requires a clear picture of how modern cybercrime operations are structured.
SocGholish: The Infiltration Layer
SocGholish operates through a deceptively simple social engineering technique: it hijacks legitimate websites by exploiting vulnerabilities in WordPress installations, then serves visitors a convincing fake browser update notification. One click delivers the malware. The attacker never needed to craft a targeted phishing email or breach a corporate perimeter — they simply poisoned the watering hole and waited. Researchers have linked SocGholish to Evil Corp, the Russian threat group with a long operational history that includes the Zeus banking trojan and the Dridex credential stealer, as well as a series of high-value ransomware deployments and large-scale money laundering schemes.
Amadey: The Persistent Foothold
Active since late 2018, Amadey functions as a paid dropper-for-hire service distributed primarily through phishing campaigns. Once on a machine, it establishes persistence, profiles the infected environment, harvests credentials, and serves as a staging platform for deploying additional payloads. Its longevity is a testament to its reliability within criminal ecosystems — nearly eight years of continuous operation suggests consistent customer demand and an equally consistent failure by defenders to eradicate it at scale.
StealC: The Harvesting Engine
StealC emerged in early 2023 and rapidly established itself as the preferred data extraction tool for criminal operators needing to monetize access quickly. It systematically pulls stored passwords, session tokens, browser credentials, and sensitive personal data, packaging it for resale on criminal marketplaces or direct deployment in fraud and account takeover schemes. Microsoft's analysis tied both Amadey and StealC to more than 140,000 infected machines globally in the first two weeks of May 2026 alone — a figure that underscores the industrial scale at which these tools operate.
"By fighting the initial stage of the attack chain, the operation strikes at the heart of the entire cybercrime-as-a-service ecosystem. Remove the loader, and the ransomware operator has no foothold left to monetize."
The Strategic Case for Targeting Enablers
Previous high-profile law enforcement actions have frequently focused on ransomware groups themselves — their infrastructure, their ransom portals, their cryptocurrency wallets. That approach delivers headlines but often limited operational disruption, as ransomware groups rebuild or rebrand with relative speed. This operation took a different architectural approach: attack the tools that every downstream operator depends on before they can execute anything else. No initial access means no lateral movement. No lateral movement means no ransomware deployment. No credentials means no fraud. The logic is elegant, and the reach is proportionally broader — disrupting three malware families simultaneously degrades the operational capability of every criminal group that relies on them, regardless of their ultimate objective.
What You Should Do
The operation's victim notification process reached affected individuals and organizations through multiple channels, including HaveIBeenPwned, Spamhaus, Shadowserver, and national cybersecurity centers. If your organization or personal accounts were among the 27 million compromised credentials recovered, the following steps are non-negotiable:
A Continuing Campaign
Europol has characterized this phase as the largest international operation ever undertaken against ransomware enablers. More than 30 public and private entities continue to support its ongoing activities, and an active suspect portal remains operational — a deliberate signal to criminal operators that the investigation is continuing, not concluded. The operation's architects are clear that each infrastructure takedown raises the cost and complexity of criminal operations, compresses their operational timelines, and forces reallocation of resources away from attacks and toward self-preservation. That sustained pressure, applied consistently across the full attack chain, represents the most credible path toward meaningful disruption of the cybercrime economy.
