From 19–22 May 2025, Eurojust and Europol coordinated an international operation, known as ‘Endgame 2.0’, targeting seven major malware variants: Bumblebee, Lactrodectus, HijackLoader, DanaBot, Trickbot, Qakbot, and WarmCookie. The operation involved law enforcement agencies from Germany, France, the Netherlands, Denmark, the UK, the US, and Canada, and resulted in international arrest warrants for 20 individuals, the takedown of over 300 servers, the seizure of €3.5m in cryptocurrency, and the neutralisation of 650 domains. This action follows Operation Endgame from May 2024, bringing the total value of cryptocurrency seized to €21.2m. Several key suspects are now subject to international and public appeals, with German authorities set to add 18 suspects to the EU Most Wanted list as of 23 May 2025.

The European Union Agency for Criminal Justice Cooperation (Eurojust) has announced that, under Operation Endgame, international law enforcement and judicial authorities from ten countries, coordinated with Europol, have dismantled a major cybercriminal infrastructure involving infostealers, Remote Access Trojans (RATs) and botnets used to steal sensitive personal and financial data. The operation targeted the Rhadamanthys infostealer and VenomRAT, which spread through phishing emails and fake antivirus pages to trick victims. The actions resulted in the takedown of 1,025 servers, seizure of 20 domains, and the arrest of a main suspect in Greece. During eleven searches, authorities recovered login data from over 100,000 cryptocurrency wallets stolen from victims but not yet used to steal assets.

Eurojust coordinated a joint investigation that resulted in the shutdown of First VPN, a criminal virtual private network service used by cybercriminals for hacking and ransomware attacks. The operation involved authorities from France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine and the United Kingdom. This effort led to the dismantling of more than 33 servers, the seizure of domain names including 1vpns.com and the search of a suspect in Ukraine.

The European Union Agency for Criminal Justice Cooperation (Eurojust) has announced the takedown of a Romanian-based money mule network, following coordinated action with Romanian, French and UK authorities. The operation resulted in preventative measures against 13 suspects and freezing of multiple properties in Romania, along with the arrest of seven suspects in the UK. Romanian authorities began investigating the group in 2020, after which Eurojust initiated a cross-border investigation and established a joint investigation team. The group, active since 2018, laundered approximately €3m by sending fake business emails to defraud victims, with 113 victims identified across Europe, particularly in the UK. The group recruited hundreds of money mules, who were set to the UK to open bank accounts for laundering the proceeds of the online fraud. Some of the proceeds were also laundered remotely from Romania, using UK SIM cards, forged UK residence documents and VPN connections. The investigation into the group remains ongoing.

Eurojust has announced that a €3m cyber fraud ring has been dismantled in a five-country operation. Eurojust and Europol have coordinated a five-country operation that dismantled an organised criminal group operating a fake online trading platform, resulting in one arrest in Cyprus. The operation, involving authorities from Germany, Cyprus, Albania, UK and Israel uncovered fraud totalling €3m affecting over 100 victims globally. The investigation, which began in 2022, forms part of the European Multidisciplinary Platform Against Criminal Threats (EMPACT) 2022-2025 cycle, with authorities conducting simultaneous searches across three countries and seizing electronic devices, documents and cash.

The European Union Agency for Criminal Justice Cooperation (Eurojust) has published its Annual Report 2024, detailing a 60% increase in case workload over five years. The report outlines the launch of the European Judicial Organised Crime Network in September 2024 and new Working Arrangements with six Latin American countries. Eurojust handled 13,000 cross-border cases in 2024, resulting in 1,200 arrests and €1bn in frozen assets. The United Kingdom was notably one of the non-EU countries with the highest participation in Eurojust cases, emphasising its crucial role in cross-border judicial cooperation.

The European Union Agency for Criminal Justice Cooperation (Eurojust) has reported that, alongside, the European Union Agency for Law Enforcement Cooperation (Europol) as well as judicial and law enforcement agencies from the UK, US, France, Germany, Sweden, the Netherlands, Australia, Canada, Japan and Switzerland, have successfully disrupted LockBit, the world’s largest ransomware group. Eurojust has also noted that two members of the group have been arrested, 34 servers have been taken down and over 200 cryptocurrency accounts related to LockBit have been frozen. This operation follows an investigation led by the National Crime Agency.

Eurojust and Europol have supported a major international operation to dismantle one of the world's largest illegal streaming services. Authorities from Italy, Croatia, the Netherlands, Romania, Sweden, Switzerland and the UK conducted over 100 searches and arrested 11 suspects in Croatia. The network, which illegally distributed films, TV series and over 2,500 pirated television channels, served more than 22 million users globally and allegedly generated over €250m in monthly illegal profits. During the operation, authorities seized and shut down the servers hosting the illegal content, as well as confiscating over €1.6m in cryptocurrency and €40,000 in cash. The economic damage to copyright holders is estimated at €10b.

Eurojust, in coordination with Europol, led an international investigation that dismantled Archetyp, one of the longest-running dark web platforms for illicit drug trade. The joint action resulted in the arrest of eight individuals, including the platform’s German creator and administrator residing in Spain, and the seizure of assets worth €7.8m. Archetyp, which had over 3,200 vendors and 600,000 users, facilitated drug sales estimated at over €250m and was one of the few platforms permitting fentanyl and other synthetic opioids.

In 2024, Eurojust, the European Union Agency for Criminal Justice Cooperation, supported several significant cross-border investigations targeting various forms of organised crime. Notable operations included the dismantling of a EUR 2 billion money laundering network in February 2024, involving Italian, Latvian, and Lithuanian authorities. In November, a sophisticated fake art operation was uncovered, potentially averting losses of EUR 200 million, with 38 arrests made and over 2,000 forged artworks seized. Other successful interventions included the takedown of online infrastructure used for terrorist propaganda, a large-scale anti-mafia operation resulting in asset freezes worth EUR 50 million, and the issuance of arrest warrants for three Belarusian officials involved in a forced plane landing. Eurojust's coordination efforts also contributed to halting malware attacks that threatened millions of users globally.

Eurojust has reported that UK authorities have initiated prosecutions against eight members of a Romanian criminal network for ATM fraud totalling €580,000. The Crown Prosecution Service is pursuing charges of cyber fraud, organised crime group membership, money laundering and payment instrument forgery. In parallel Romanian action, the Directorate for Investigating Organised Crime and Terrorism has questioned two additional suspects and conducted 18 property searches. The operation was coordinated through a Eurojust-supported joint investigation team between UK and Romanian authorities, with analytical support from Europol. The criminal network allegedly manipulated ATMs to extract cash while falsifying transaction cancellations.

The European Union Agency for Criminal Justice Cooperation (Eurojust) has reported that under an operation coordinated by them as well as the UK National Crime Agency, authorities have taken action against malware systems including IcedID, Pikabot, Smokeloader and others which infiltrated computers via emails. Criminal services were disrupted through arresting four suspects, freezing illegal proceeds and taking down botnets using the 'sinkholing' technique. More than 100 servers were taken down or disrupted and more than 2000 domains were taken over by law enforcement authorities. According to the investigation, one of the main suspects accumulated at least €69m in cryptocurrency by renting out criminal infrastructure to deploy ransomware.