DanaBot Disrupted: Inside the Global Takedown of a Cybercrime Powerhouse

For years, DanaBot fuelled global cybercrime—stealing credentials, delivering ransomware, and thriving as a malware-as-a-service (MaaS) platform. On 22 May 2025, international law enforcement disrupted DanaBot and arrested several allegedly associated individuals as part of Operation Endgame, a sweeping effort led by global agencies and partners including Proofpoint. Europol called it the “largest ever operation against botnets, which play a major role in the deployment of ransomware.” The impact was significant: In March 2023, 17% of email campaigns in Proofpoint data were linked to initial access brokers (IABs) targeted by Endgame. By February 2025, that figure had dropped to just 1%. Hear directly from the head of Proofpoint Threat Research on the front lines. He will unpack DanaBot’s evolution, how it was dismantled, and what this means for the future threat landscape. Don’t miss this insider look at how global collaboration is reshaping cyber defence—one takedown at a time.