ATHENS, November 14 – The Cybercrime Division of the Hellenic Police Headquarters actively participated in the international operation code-named ‘Operation Endgame’. This collaborative effort led to the arrest in Greece of a key suspect involved in the creation and sale of Remote Access Trojan (RAT) malware.
International Cooperation Against Cybercrime
As highlighted in the official announcement, the operation was coordinated by Europol and Eurojust. It involved law enforcement and judicial authorities from Australia, Belgium, Canada, Denmark, France, Germany, Greece, Lithuania, the Netherlands, the United Kingdom, and the United States. Over 30 national and international public and private entities supported the initiative.
The primary objective of ‘Operation Endgame’ was to dismantle infrastructures responsible for infecting thousands of computers with malicious software.
Data Collection and Suspect Identification
In this context, the Cybercrime Division, leveraging intelligence gathered in collaboration with foreign authorities, collected data concerning the criminal activities of an internet user in Greece.
According to the Police, the user was identified as the creator and seller of a program designed to steal information through keylogging, remote webcam access, text file infiltration, and cryptocurrency wallet breaches. The malware was sold based on desired usage duration and services provided, with prices ranging from 150 euros per month to 1,550 euros for 12 months.
The collected evidence was presented to the competent prosecutorial authority, which ordered a preliminary investigation.
Further investigation by the Cybercrime Division, utilizing data from both foreign and domestic companies, led to the identification of a 38-year-old foreign national and the determination of his residence in the Attica region.
Raid and Seizures in Athens
Subsequently, pursuant to a prosecutorial order, following a request for a European Investigation Order from French authorities, and in collaboration with Europol and Eurojust, a search was conducted at the suspect’s residence on November 3, 2025. The search was carried out in the presence of a judicial officer, with representatives from the FBI acting as observers, officers from the Paris Judicial Police Department attending, and personnel from the Hellenic Police Forensic Division.
During the search, authorities seized the following items:
- 11 debit cards from foreign and Greek banking institutions, one of which was a ledger mastercard used to transfer funds from cryptocurrency wallets.
- 15,205 euros in cash and 8,134.56 euros in cryptocurrencies.
- A metal plate engraving package for digital wallet recovery words.
- 7 hard drives.
- 5 mobile phones.
- 3 external USB storage devices.
- A “hardware wallet” containing cryptocurrencies totaling approximately 140,424.78 US dollars.
Additionally, during the on-site examination of the suspect’s computer, various versions of malicious software source code were discovered. Evidence also indicated the management of a website promoting the RAT malware, as well as email accounts, cryptocurrency accounts, and other data linking him to the illicit activity. The operation of the website managed by the suspect has been terminated.
Charges and Detention
The 38-year-old faces charges for the prohibition of trafficking in software, surveillance devices, and other data, violation of the privacy of telephone and oral communication, unauthorized access to computer systems on a professional and continuous basis, and violation of legislation concerning the prevention and suppression of money laundering from criminal activities.
The arrested individual was brought before the competent prosecutorial authority and referred to an examining magistrate, who ordered his provisional detention. He has since been transferred to a detention facility. Furthermore, a European Arrest Warrant was issued by French authorities, leading to an Arrest and Provisional Detention Order from the competent Court of Appeal.
Broader Impact of ‘Operation Endgame’
As noted in the relevant announcement, during the international ‘Operation Endgame’, an additional 10 searches were conducted (9 in the Netherlands and 1 in Germany). Access to 1,025 servers globally was disrupted, and 20 websites (domains) were seized.
Citizens can check if their computer has been infected and access information on necessary actions at politie.nl/checkyourhack and haveibeenpwned.com.
Further information regarding this criminal activity is available on the ‘Operation Endgame’ website at www.operation-endgame.com.
