News release

Criminal infrastructure dismantled by RCMP Cybercrime Investigative Team – Vancouver and international partners during Operation Endgame

November 13, 2025 - Federal Policing – Pacific Region, British Columbia
From: British Columbia RCMP

Content

This week, investigators with the RCMP Federal Policing – Pacific Region, Cybercrime Investigative Team - Vancouver (CIT-V) in partnership with international law enforcement agencies succeeded in dismantling an infostealer, a Remote Access Trojan (RAT), and a botnet, all of which played a role in international cybercrime.

This is the third large-scale action in Operation Endgame (English only) which was initiated in 2022 and is the largest operation ever conducted to combat criminal infrastructure used for ransomware attacks worldwide and target cybercriminals who utilize malicious software to victimize people, including Canadian victims. The RCMP is a partner in this operation.

Operation Endgame is a collaboration between the authorities of the Netherlands, Germany, the United States, Australia, France, Denmark, Belgium, the United Kingdom and Canada, with the support of Europol and Eurojust.

The Operation enabled authorities to simultaneously take down the infostealer, RAT and botnet and disrupt the infrastructure used by cybercriminals. These malware can be used for different types of cybercrime, for example ransomware. One of the biggest infostealers (Rhadamanthys), a RAT (VenomRAT) and botnet (Elysium) are dismantled and taken down. The main suspect for VenomRAT was arrested in Greece on the 3rd of November.

Infostealers and botnets are among the software most commonly used worldwide to steal sensitive personal data (e.g., passwords and banking details) from devices. Criminal services have a business model in which a cybercriminal can buy a botnet – a network of infected computers – so they can take control over these computers and transfer the data onto their own server. A RAT is software with which a cybercriminal can log into a single base computer and then control all registered computers remotely. Cybercriminals use this software to gain full control over a digital system.

In total 1025 servers were dismantled, 20 domain names were seized, there was 1 arrest and 11 searches worldwide (9 searches in the Netherlands, 1 in Germany and 1 in Greece).

“Cybercrime knows no borders, and neither does our response. Operation Endgame demonstrates that when law enforcement agencies unite across jurisdictions, we can dismantle even the most sophisticated criminal networks,” said Superintendent Adam MacIntosh, Officer in Charge of the Cyber and Financial Investigation Teams in the Pacific Region. “Through direct participation alongside our international partners, we’re sending a clear message: there is no safe haven for those who exploit the digital landscape to harm our communities, businesses and infrastructure.”

CIT-V thanks RCMP Federal Policing Cybercrime and the National Cybercrime Coordination Centre (NC3) for their support in the ongoing effort to combat cybercrime.

Public Advisory

The RCMP urges all Canadians to prevent online malware infections:

• Keep software updated
• Use trusted security software
• Think before you click on unexpected email attachments, unfamiliar links and pop-up ads
• Use strong, unique passwords
• Only download software or files from official or verified websites
• Backup important data
• Secure your Wi-Fi

The RCMP strongly recommends that anyone who has been a victim, or was targeted by fraud or cybercrime, contact their local police immediately. It is also important you report the incident to the Report Cyber and Fraud website or by phone at 1-888-495-8501. Reporting is critical as it enables law enforcement measures to combat cybercrime and helps identify linkages across separately reported incidents.

Quotes

“Policing is at a critical juncture with technology driving rapid evolution in the criminal threat landscape. To effectively respond to this evolving threat police must also adapt by transforming operations. Operation ENDGAME is an example of what is possible when the full weight of the international law enforcement community mobilizes against dangerous cyber threats. The results demonstrate the significant impact our domestic and international partnerships have and the progress we continue to make in building collective resilience against destructive cyber activities.”

Inspector Shaun Foley, Federal Policing Cybercrime, RCMP National Headquarters

“An effective police response to cybercrime goes beyond pursuing offenders to disabling the tools and systems that they rely on to commit their crimes. Operation Endgame exemplifies the level of collaboration required to effectively identify and shut down these systems to prevent further victimization, both in Canada and abroad. By pulling together insights from partners around the world, we are better able to protect Canadians from malicious cyber activities.” 

Chris Lynam, Director General, RCMP National Cybercrime Coordination Centre (NC3)

Quick facts

• Cybercrime Investigative Team - Vancouver is one of five national level RCMP cybercrime teams working together to combat online crime in Canada. There are CITs located in Edmonton, Ottawa, Montreal, Toronto and Vancouver.

  CIT-V investigates the highest levels of cybercrime threatening Canadians and our national interests. This includes cybercrime involving and/or directed against:

  • Institutions of government
  • Critical infrastructure of national importance
  • Cyber systems to conduct foreign-influenced activities

  Working in partnership with domestic and international partners to investigate, prosecute, and disrupt significant threats within the cybercrime ecosystem including criminals who develop malware, provide cybercrime services and infrastructure, and facilitate attacks against critical infrastructure, including Foreign State actors and advanced persistent threats.

Contacts