Log in Request a demo

Glossary

Law Enforcement Takedown.

Also called Botnet takedown, Infrastructure takedown, Cybercrime takedown

In Short

A law enforcement takedown is a coordinated action in which police and prosecutors shut down or seize the servers, domains or other infrastructure that criminals use. Its aim is to stop a criminal service from working. These actions often involve several countries.

Last updated October 23, 2026
Profile MapGlossary Term
  1. Also Called3other namesBotnet takedown · Infrastructure takedown · Cybercrime takedown
  2. Related Terms3linked entriesSinkhole · Malware-as-a-service (MaaS) · Infostealer

What Is a Law Enforcement Takedown?

It is an operation where authorities disable the technical systems behind cybercrime. These systems can be servers, domain names, or networks of infected computers called botnets. Takedowns can come with searches, seizures and arrests. This page uses public examples to show how it works.

What Does a Takedown Look Like in Practice?

Eurojust, the European Union agency for judicial cooperation, describes a large international malware operation. It says authorities from ten countries took part, with Eurojust coordinating judicial cooperation and Europol giving support. Eurojust says the action dismantled 1,025 servers worldwide and seized 20 domain names used by cybercriminals. It says 11 searches were carried out, and that the main suspect connected to the remote access trojan was arrested in Greece. Eurojust also says investigators found login data from more than 100,000 cryptocurrency wallets, stolen from victims but not yet used to steal assets.

Eurojust says the action targeted an infostealer, a remote access trojan and a botnet. It adds that authorities, together with multiple private cybersecurity organizations, took down a criminal infrastructure that is critical for several cybercriminals’ businesses. An infostealer is malware that steals data such as passwords. A remote access trojan lets an attacker control a computer from afar.

Operation Endgame shows that takedowns come in repeated phases. Eurojust published four of them.

Operation Endgame Phases
  1. May 2024Droppers targetedFour arrests, 16 searches, over 100 servers down, over 2,000 domains under police control.
  2. 19 to 22 May 2025Second action weekOver 300 servers down, 650 domains neutralised, 37 suspects identified.
  3. November 2025Infostealer, remote access trojan, botnet1,025 servers down, 20 domains seized, 11 searches.
  4. 15 to 19 June 2026SocGholish, StealC and Amadey326 servers and 142 domains neutralised, 27 million compromised data sets recovered.

A second public example is a leak site takeover. Europol says that on 30 September 2026 law enforcement took control of the leak site of the KillSec ransomware group. It secured at least 110 terabytes of data against further unauthorised access. Europol says the group used the site to threaten organisations with publication of stolen files unless they paid a ransom.

A third example is a domain seizure. The US Attorney’s Office for the Eastern District of Virginia announced on 27 October 2026 that it had seized virtualine.net, after court authorization, with help from law enforcement in Germany, the Netherlands and the UK. Read our news post on the Virtualine seizure.

Why Target Shared Infrastructure?

Some criminals may rent or share the same tools and servers. Removing that shared infrastructure can interrupt many of them at once, which is why takedowns often target services rather than single victims. A takedown does not end crime for good, because criminals can rebuild or move to other tools, so it is one part of a wider defense.

What Should You Do After a Takedown Is Announced?

  • Read public notices from police and agencies after a takedown, as they may list ways to check whether you were affected.
  • Change passwords and review accounts if you are told your data was involved.
  • Keep monitoring for new activity, since the same actors may return.

Is a Takedown the Same as a Sinkhole?

No. A sinkhole redirects traffic from infected computers to a controlled machine. A takedown is the whole operation, and it can use sinkholing as one method among others.

Is a Takedown the Same as a Brand Impersonation Takedown?

No. A brand takedown is a request to remove a fake site or account that copies a company. A law enforcement takedown is a legal operation against criminal infrastructure.

Also Called.

  • NameBotnet takedown
  • NameInfrastructure takedown
  • NameCybercrime takedown

Questions.

  • What is a law enforcement takedown?

    A law enforcement takedown is a coordinated action in which police and prosecutors shut down or seize the servers, domains or other infrastructure that criminals use. Its aim is to stop a criminal service from working, and it often involves several countries.

  • What happens in a takedown?

    Authorities disable the technical systems behind cybercrime, such as servers, domain names or botnets. Takedowns can come with searches, seizures and arrests. In the Eurojust example, 1,025 servers were dismantled and 20 domains seized.

  • Does a takedown end cybercrime for good?

    No. Criminals can rebuild or move to other tools, so a takedown is one part of a wider defense. It can still interrupt many criminals at once when they share the same infrastructure.

  • What should I do after a takedown is announced?

    Read public notices from police and agencies, as they may list ways to check whether you were affected. Change passwords and review accounts if you are told your data was involved, and keep monitoring for new activity.

Sources

  1. 1 Authorities continue to protect citizens from cybercriminals during major malware operation, Eurojust
  2. 2 Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site, Europol
  3. 3 Europol: 1,025 servers taken down in the latest phase of Operation Endgame, which targeted Rhadamanthys, VenomRAT and Elysium, Europol
  4. 4 Eurojust: May 2024 phase: droppers, arrests, searches, servers, domains, Eurojust
  5. 5 Eurojust: Action week of 19 to 22 May 2025: servers, domains, suspects, Eurojust
  6. 6 Eurojust: Action week of 15 to 19 June 2026: servers, domains, data sets, Eurojust
  7. 7 Bulletproof website domain seized in international law enforcement operation (27 October 2026), US Department of Justice

In Our Research

  1. 1 Virtualine Bulletproof Hosting Seized: What the DOJ Says the Service Did October 2026
  2. 2 BreachForums and DarkForums: takedown timeline October 2026
  3. 3 Ransomware Trends Report | Q3 2025 October 2025
  4. 4 Ransomware Trends Report | Q3 2024 October 2024
  5. 5 How to Access the Dark Web Safely and Is It Legal? March 2023
  6. 6 Takedown Service Evaluation Checklist 101 guide

Keep Exploring.

Knowledge Hub
101 guide Takedown Service Evaluation Checklist What to check before buying a takedown service: scope, evidence, who files, reporting and what is not promised. Open 101 guide Hacker And Leak Forums 101 What hacker and leak forums are, what is traded there, how they run, why police take them down and why new ones appear, and what defenders do about it. Open Glossary term Botnet A botnet is a group of hijacked internet-connected devices that an attacker controls remotely and uses to carry out large scale attacks. Open Glossary term Remote Access Trojan (RAT) A remote access trojan, or RAT, is malware that lets an attacker control a computer from a distance. Open

Browse The Library.