Operation Endgame Strikes Again: International Crackdown Targets Buyers of Smokeloader Malware

A New Era in Cybercrime Enforcement Begins

In a major development following last year’s sweeping action against malware infrastructure, international law enforcement has now turned its attention to a new target: the buyers of illicit cyber services. On April 9, 2025, authorities announced the second phase of Operation Endgame — a coordinated global effort to pursue not just those who supply malware, but also those who fund and exploit it.

This phase marks a strategic escalation in how cybercrime is tackled. While the first wave focused on dismantling the technical backbone of criminal operations, the latest actions shine a spotlight on the “demand side” — those who used platforms like Smokeloader to gain unauthorized access to computer systems. The shift sends a resounding message: using these tools makes you just as culpable as the ones who build them.

Smokeloader, a notorious pay-per-install botnet run by the elusive cybercriminal ‘Superstar’, provided a gateway for attackers to infect systems and unleash a range of malicious payloads. Thanks to key data seized during last year’s enforcement wave, investigators have been able to connect the dots between digital pseudonyms and real-world perpetrators — and now, they’re facing the consequences.

Operation Endgame Phase Two: What You Need to Know

Global Follow-Up: Law enforcement in North America and Europe has launched the second phase of Operation Endgame, expanding last year’s unprecedented action against major malware networks.
Focus Shift: Unlike the 2024 takedown, which dismantled infrastructures such as IcedID, Bumblebee, SystemBC, and Smokeloader, this latest operation targets the customers of these malicious services.
Key Player – Smokeloader: The focal point is the Smokeloader botnet, a modular malware used for payload delivery, surveillance, and system compromise.
‘Superstar’ Under Watch: Operated by a cybercriminal known as ‘Superstar,’ Smokeloader allowed users to buy access to infected systems — a service that became popular in dark web circles.
New Targets: At least five individuals have been arrested for purchasing access via Smokeloader; others faced home searches, warrants, and interrogations.
Crucial Database: The breakthrough came from a key database seized during the original May 2024 operation, which linked pseudonyms to physical identities.
Malware Monetization: Some suspects didn’t just use the malware — they resold access, turning a profit from the infections.
Suspect Cooperation: Several individuals chose to collaborate, turning over devices and information that has widened the investigation.
Massive Scope: The initial phase saw 100+ servers taken down, 2,000+ domains seized, and arrests in ten countries.
International Coalition: Europol, J-CAT, FBI, and agencies from Germany, France, Denmark, the U.S., Canada, and more are all involved.
Public Warning: Authorities launched operation-endgame.com for suspects to check if they’re being watched — with a blunt message: “We will not stop here.”
Long-Term Vision: FBI Director Christopher Wray emphasized that this is far from over, as cybercrime adapts rapidly and so must the response.
Rising Stakes: This pivot to targeting buyers raises the stakes for cybercriminals worldwide, deterring both developers and customers of malware services.
Clear Message: No longer can offenders hide behind anonymity. Law enforcement is watching both sides of the digital black market.

What Undercode Say:

This second act of Operation Endgame reflects a transformative evolution in the battle against cybercrime — one that shifts the lens from just disabling tools to holding users accountable. Historically, law enforcement efforts have focused on neutralizing the source — malware developers, botnet controllers, and infrastructure maintainers. However, Operation Endgame is rewriting the rules, applying pressure to the very economy that fuels this criminal underworld.

Smokeloader, a potent and adaptable tool in the malware arsenal, exemplifies how cyber tools are commoditized. It wasn’t just a piece of malicious software — it was a marketplace service. Buyers could pay to deploy payloads across compromised networks, knowing their activities would likely remain undetected. These users often operated with a false sense of immunity, believing the suppliers bore all the legal risk.

That illusion has been shattered.

The

What makes this phase so significant is its long-term deterrent value. Cybercrime thrives on perceived impunity. Buyers once thought of themselves as distant, almost abstract, from the crime — like customers in a black market store, not accomplices in digital theft. This initiative reframes their role entirely. If you buy malware access, you’re part of the conspiracy — and law enforcement will come knocking.

It also showcases unprecedented international collaboration. With agencies from North America, Europe, and beyond coordinating in real-time, the response to cybercrime is becoming as borderless as the crime itself. The use of a public-facing platform, operation-endgame.com, further demonstrates transparency and reach. It’s a psychological tactic as much as a strategic one — alerting suspects and encouraging more to come forward or face the full brunt of legal consequences.

From ransomware deployment to cryptojacking and surveillance, the scope of misuse stemming from Smokeloader access is staggering. By tracing not just the malware but the acts it enabled, authorities are building broader cases — not just for malware possession but for wire fraud, extortion, privacy violations, and more.

If there’s a broader takeaway, it’s this: cybercrime isn’t safe anymore. Buyers are no longer shielded by their screens, aliases, or crypto wallets. The global justice system is catching up — and it’s fighting back with coordination, data, and persistence.

Fact Checker Results:

Operation Endgame Phase Two has been officially confirmed by Europol and partner agencies.
Arrests and digital evidence were directly linked to data seized during the 2024 raids.
The Smokeloader malware was indeed sold as a pay-per-install service, often used in larger cybercriminal campaigns.