During the international Operation Finale, Europol authorities stopped the large-scale activity of the crypto-ransomware malware ecosystem and the operation of IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot drops.

The operation, which took place from 27 to 29 May, was initiated by Europol authorities from France, Germany and the Netherlands, and was also supported by Eurojust, Denmark, the UK and the USA.

Law enforcement agencies from Armenia, Bulgaria, Lithuania, Portugal, Romania and Switzerland were involved and supported the operation with actions such as arrests, searches and interrogations of suspects, as well as the seizure of servers and removal of domains. During the operational actions, several people were arrested, more than 100 servers were disabled and more than 2,000 domains were taken under control around the world.

The investigation revealed that one of the main suspects earned at least 69 million euros ($75 million) in cryptocurrency by renting out criminal infrastructure to install and distribute ransomware. Europol's official statement does not disclose the amount of damage, nor which digital assets or blockchain platforms were used by the criminals for cryptocurrency transactions.

The day before, the US Department of Justice accused the creator of the 911 S5a botnet, Yun He Wang, of illegally collecting personal data, compromising more than 19 million private IP addresses and reselling confidential information to cybercriminals for cryptocurrency.