LAST UPDATED: 2025-12-15
DEFAULT SEVERITY LEVEL: CRITICAL
This Special Report contains information about IP addresses and computer systems that are believed to have been infected with Rhadamanthys information stealing malware. It is a result of the continuing international Law Enforcement action called Operation Endgame, and a third season of action that was announced on November 13th 2025. The first Special Report dated 2025-11-12 contained data covering the period between 2025-03-14 and 2025-11-11.
New: the second Special Report dated 2025-12-02 covered the same period and contained an expanded set of victim data, which included additional data obtained from seized criminal infrastructure that was not available at the time the first Special Report was run. Note: Due to a technical issue that potentially impacted some large report file downloads, the second Special Report was re-run on 2025-12-15. This Special Report contains the same data as 2025-12-02, but was resent again in case downloads of the original second Special Report were not 100% successful for all recipients. This time public notifications were also sent and our original supporting blog post was updated on 2025-12-16 to include expanded statistics.
Shadowserver Special Reports are unlike all of our other standard free daily network reports. They do not cover a specific daily 24-hour time period.
Instead, we send out Special Reports in situations where we are able to share one-time, high value datasets that we feel should be reported responsibly for maximum public benefit. Sometimes there are incidents when it would be useful to be able to notify potential victims about events or breaches that may have impacted them outside of the previous 24-hour period, when it may take a number of days for incident responders to conduct forensic investigations and analyzed data becomes available for sharing with potential victims. Although the events included in these Special Reports will fall outside of our usual 24-hour daily reporting window, we believe that there would still be significant benefit to our constituents in receiving and, hopefully, acting on the retrospective data.
If you have missed a Special Report because you were NOT yet a subscriber at the time a report was pushed out, simply subscribe for your network now and specifically request all recent Shadowserver Special Reports – and we will regenerate them specifically for your network, at no cost.
Note that the data shared across special reports may differ on a case by case basis, hence the report formats for individual Special Reports may be different.
The data in this Rhadamanthys Historical Bot Infections Special Report was provided to Shadowserver by the Operation Endgame Law Enforcement partners to disseminate to National CERTs/CSIRTs and network owners globally, to maximize remediation efforts.
Note that exact timestamps were not available for individual events, so the timestamp field is set to either “2025-11-12 00:00:00”,“2025-12-02 00:00:00” or“2025-12-15 00:00:00”. Since only the first and last seen time for an infection was recorded in the Rhadamanthys database, the first and last seen dates for an infected victim system represent a date range when an infection was likely active. However, there could have been multiple infections during that time period for shorter individual time periods (and therefore periods without an active infection).
This special report has severity level CRITICAL set on all events. Severity levels are described here.
Filename prefix: 2025-11-12-special, 2025-12-02-special and 2025-12-15-special. Note: these are accessible in the API using 2025-11-12, 2025-12-02 and 2025-12-15 as the search date.