RCMP joins Operation Endgame strike on Rhadamanthys, VenomRAT and Elysium
The RCMP says its Vancouver cybercrime team helped international partners dismantle 1,025 servers and seize 20 domains used by the Rhadamanthys infostealer, the VenomRAT remote access trojan and the Elysium botnet, in an Operation Endgame action announced Nov. 13.
The operation matters because all three tools sit near the start of many intrusions. Infostealers harvest passwords, browser cookies and crypto wallet keys that are later sold or used to break into corporate networks, and the RCMP said the malware had harmed people around the world, including Canadian victims.
What happened
According to the RCMP news release, the Cybercrime Investigative Team in Vancouver, part of Federal Policing Pacific Region, worked with the RCMP's National Cybercrime Coordination Centre and with police from the Netherlands, Germany, the United States, Australia, France, Denmark, Belgium and the United Kingdom. Europol and Eurojust supported the effort.
Police searched 11 locations: nine in the Netherlands, one in Germany and one in Greece. The main suspect behind VenomRAT was arrested in Greece on Nov. 3.
The Register reported that the server seizures ran from Nov. 10 to 13 and that investigators, helped by the Shadowserver Foundation, accessed a database showing more than 525,000 Rhadamanthys infections in 226 countries between March and November 2025. Authorities said the principal Rhadamanthys suspect had access to more than 100,000 cryptocurrency wallets belonging to victims. On Nov. 11, the malware's administrator told customers to stop using it, and its onion site went offline hours later. The administrator and customers remain at large.
Rhadamanthys was first seen in 2022 and was rented to criminals by subscription. Proofpoint, cited by The Register, said it recorded more Rhadamanthys activity in 2025 than in any earlier year.
Why it matters for Canada
Operation Endgame, launched in 2024 and coordinated through Europol, targets the services that ransomware gangs and fraudsters rely on rather than individual attacks. "Cybercrime knows no borders, and neither does our response," Supt. Adam MacIntosh said in the RCMP release. Chris Lynam of the National Cybercrime Coordination Centre said an effective police response includes disabling the tools criminals depend on.
The RCMP did not say how many Canadians were affected. Stolen credentials from infostealer logs can stay in circulation long after the infrastructure that collected them is gone.
What to do
- Keep operating systems, browsers and security software up to date, and download software only from official sources.
- Use strong, unique passwords and turn on multi-factor authentication, especially if a device may have been infected.
- Be cautious with unexpected attachments, unfamiliar links and pop-up ads.
- Victims can contact local police and file a report through the Report Cyber and Fraud system or by calling 1-888-495-8501.
