Law enforcement agencies in multiple countries have announced the arrests of users of the malicious Smokeloader botnet.
April 10, 2025 By Ionut Arghire
Law enforcement agencies in the US and six other countries have been identifying customers of the Smokeloader pay-per-install botnet and have made five arrests, Europol announced.
The Smokeloader botnet was disrupted in May 2024 as part of Operation Endgame and led to the destruction of the infrastructure of several malware droppers, including Bumblebee, IcedID, Pikabot, SystemBC, and Trickbot.
The botnet’s customers, Europol said on Wednesday, were registered in a database that was seized by law enforcement in May last year. This enabled follow-up actions against the botnet’s users, as authorities were able to link online personas with real-life individuals.