News & Insights

On Wednesday 24th June 2026, international law enforcement partners announced additional successful cyber crime disruption actions as part of the ongoing Operation Endgame initiative. This time the StealC infostealer and Amadey malware-as-a-service families were targeted. Law enforcement acquired almost 30 million compromised credentials stolen by StealC between 4th July 2025 and 16th June 2026. Shadowserver is sharing elements of this dataset in another one-off Special Report, to allow historical and recently compromised Windows computers to be remediated by system defenders. High level analysis of the stolen credentials is provided.

On Thursday 18th June 2026, international law enforcement partners announced another successful cyber crime disruption action as part of the ongoing Operation Endgame initiative. This time it targeted the SocGholish malware platform and threat actors. Law enforcement acquired credentials for approximately 1.4 million compromised WordPress sites from the period May 2023 to May 2026. Shadowserver is sharing elements of this dataset in another one-off Special Report, to allow historical and recently compromised WordPress credentials to be remediated by system defenders. High level analysis of compromised WordPress sites is provided.

Shadowserver issued a report to inform government leaders, policymakers, and other key stakeholders in ECOWAS Member States in West Africa on the following: a) The ECOWAS region’s cyber threat landscape and attack surface using Shadowserver’s free, actionable cyber threat intelligence, technical analysis, and expert insights b) The region’s institutional and operational cybersecurity deficiencies (“gaps”) that make it increasingly vulnerable to cyber threats c) Recommended actions that can be undertaken at the national and regional levels to address the identified gaps, improve digital security, and enhance cyber resilience in the region d) The potential economic and societal impact should the identified institutional and operational cybersecurity gaps remain unaddressed.

On Thursday 13th November 2025, international law enforcement partners announced a disruption action against the Rhadamanthys information stealer malware. As part of the ongoing Operation Endgame initiative, law enforcement acquired copies of the threat actor’s databases containing historical Rhadamanthys infections, which covered the period March 2025 to November 2025. These databases contain records of over 86 million stolen data items from over 525,000 Rhadamanthys infections across 226 countries. Shadowserver is sharing elements of this dataset as a one-off Special Report, to allow historical Rhadamanthys infections to be investigated and any secondary malware identified and remediated by system defenders.

A review of Shadowserver’s 20th year as the world’s largest provider of free, timely, actionable, daily cyber threat intelligence. Covering the latest improvements in our public benefit services, responses to emerging cyber threats, and detection and reporting of the latest vulnerabilities to National CSIRTs and system defenders globally. We provide highlights of our cybersecurity capacity building efforts, plus successful outcomes from our free support to Law Enforcement in major cybercrime disruption operations.

On Tuesday 29th August 2023, the US DoJ and FBI, together with other global law enforcement partners, announced a disruption action against the Qakbot botnet. This involved the FBI deleting the Qakbot malware from infected victim computers under US court order. As part of their operation, the FBI acquired a copy of the threat actor’s database of historical Qakbot infections, which covered the period July 2019 to August 2023. This database contains a record of over 700,000 discrete Qakbot bot infections in 230 countries. Shadowserver is sharing elements of this dataset as a one-off Special Report, to allow historical Qakbot infections to be investigated and any secondary malware identified and remediated by system defenders.

On Tuesday 29th August 2023, the US Department of Justice (DoJ) and US Federal Bureau of Investigations (FBI) - along with law enforcement partners in France, Germany, the Netherlands, and the United Kingdom - announced a disruption action against the very long running Qakbot botnet. The outcomes from the coordinated law enforcement action included deleting the Qakbot malware from infected victim computers (to reduce the risk of further harm), taking down the Qakbot technical infrastructure and seizing $8.6M of alleged illicit cryptocurrency profits. The Shadowserver Foundation is happy to support our law enforcement partners in this major cybercrime disruption operation.

The UK’s National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on nation-state sponsored exploitation of router infrastructure. The alert calls out SNMP public exposure and one vulnerability in particular - CVE-2017-6742 - which relates to a long known “remote code execution” opportunity on certain Cisco routers. This alert is a timely reminder for all with unpatched equipment to think broadly! We use this opportunity to highlight our data and free daily reports that provide information on the SNMP and Cisco device exposed attack surface (and more!).

We are happy to announce multiple enhancements to our public Dashboard, particularly to the Exploited Vulnerability data collected by our server-side honeypot sensors, thanks to funding provided by the UK Foreign Commonwealth and Development Office (FCDO).

We are happy to announce the first major extension to our newly launched Dashboard - the addition of IoT device statistics and server-side attack statistics, data sets that have been collected as part of the HaDEA EU CEF VARIoT project.