Operation Endgame leads to the arrest of Smokeloader botnet clients

Europol announced on April 9, 2025, that it had coordinated, in early 2025, the arrest of several clients of the Smokeloader botnet, operated by the cybercriminal known as “Superstar.” These actions follow the international police operation “Endgame,” which had led, in May 2024, to the takedown of several major cybercriminal tools, including IcedID, SystemBC, Pikabot, Smokeloader, and Bumblebee.

At the time, law enforcement had seized a Smokeloader database listing all clients who had rented the botnet for cybercriminal activities. This information enabled authorities to carry out “arrests, searches, and arrest warrants,” according to Europol’s statement.

“Clients of these Crime-as-a-Service providers are now learning the painful lesson that their personal data was not protected by individuals who, inadvertently, painted targets on their backs,” the statement also reads.

Europol notes that this crackdown concerns lower-level criminals compared to those arrested in May 2024. Authorities were also able to rely on the cooperation of several suspects previously arrested. According to the European agency, Endgame will continue, with further police actions already scheduled.