Two years of coordinated takedowns have reshaped the loader and botnet landscape more than any single arrest ever did. Operation Endgame in May 2024 tore down a large part of the dropper ecosystem in one week. The 2025 follow-ups went after the families that filled the gap. From where we track, the interesting question in late 2026 is not whether the takedowns worked, because they plainly disrupted real infrastructure, but what the ecosystem looks like now that it has had time to reorganize around the holes.
This is a landscape read, not an IOC drop. We are pulling together what is publicly documented about the operations and setting it against the behavior we watch on the tracking side, because the two together tell a clearer story than either does alone.
What actually came down
The Operation Endgame action in May 2024 was the largest coordinated hit on the dropper layer to date. It targeted the loaders that sit between an initial lure and a final payload, the ones that made the malware-as-a-service economy modular in the first place: IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, and the remnants of Trickbot. Europol framed it as going after the delivery layer rather than any single end payload, which was the right target. The loader is the reusable part. Take down the loader network and every affiliate renting it feels the outage at once.
The 2025 follow-ups pushed further up the same supply chain. In May 2025 a Microsoft-led civil action, with DOJ and Europol alongside, moved against Lumma Stealer and seized or sinkholed roughly 2,300 domains tied to its command-and-control. Around the same window, DanaBot infrastructure was named in a US indictment and disrupted as part of the continued Endgame effort. The pattern across both years is consistent: hit the shared infrastructure and the operator identities behind it, not the individual campaigns.
The gap did not stay empty
Here is the part that matters for anyone tracking this. A takedown removes infrastructure and, when it is good, raises the operators’ costs and their risk. What it does not do is remove the demand. The affiliates who were renting IcedID or Smokeloader still need a loader the Monday after. Demand that concentrated is a market signal, and markets route around outages.
So the families that survived or launched into the gap did well. The observable shifts, in broad terms:
- Consolidation onto the survivors. Loaders that were not named in the actions, and the ones that rebuilt quickly, absorbed the affiliate demand. We covered one of them in detail when we mapped the Amadey distribution network earlier this year, and Amadey is a fair example of the pattern: an older, unglamorous loader that gained relevance precisely because bigger names went dark.
- Delivery moved toward the human. With automated dropper chains under pressure, the delivery layer leaned harder on techniques that put the victim in the loop. The ClickFix pattern we wrote up in August, where a fake verification prompt talks the user into pasting a command themselves, is the clearest example. It is cheap, it needs no exploit, and it sidesteps a lot of the infrastructure that takedowns target.
- Faster, cheaper rebuilds. The reboots came back leaner. Fewer hardcoded domains, more reliance on dead-drop resolvers and bulletproof-adjacent hosting that is quick to rotate. The design lesson the operators took from Endgame was to hold less standing infrastructure, because standing infrastructure is what gets seized.
Why the model is resilient by construction
None of this is the ecosystem being clever in some special way. It is the malware-as-a-service structure doing what it was built to do. The whole point of separating the loader, the payload, and the affiliate is that any one of the three can be replaced without the others noticing much. That modularity, mapped cleanly onto Ingress Tool Transfer (T1105) and the staging techniques under Stage Capabilities (T1608), is exactly what makes the network hard to kill. Remove one loader and the affiliate swaps in another with a config change. The staging model that ThreatFox and MalwareBazaar catalog every day is the same one that lets an operator stand a family back up in weeks.
The families themselves have not become more advanced in response. Length-prefixed configs, RC4 and single-byte obfuscation, dead-drop resolvers pointing at legitimate platforms: this is the same toolbox that was in use before the takedowns. What changed is the logistics around it, not the malware. Operators hold less, rotate faster, and lean on delivery that does not need much infrastructure at all. Calling any of it advanced would be overstating it. It is well-organized, which is a different and more durable thing.
What this means for tracking in late 2026
The takedowns changed what a useful indicator looks like. When operators held standing infrastructure, a domain block or a sinkhole entry had a long useful life. Now that the reboots rotate aggressively and lean on dead-drop resolvers hosted on legitimate services, a single domain or IP ages out fast. The durable signals have moved up a layer, toward behavior and structure:
- Config structure over config contents. The specific C2 in a config blob rotates within days. The way a family lays out its config, the derivation of its keys, the shape of its second-stage fetch, changes far more slowly, because changing it means re-tooling the panel and every affiliate build.
- Delivery tradecraft over delivery infrastructure. A ClickFix lure’s exact domain is disposable. The pattern, a fake prompt driving manual execution, is stable and detectable regardless of where it is hosted. The endpoint side of that is where the reliable signal lives now, which is why we spent a whole post on the endpoint signals infostealers cannot hide.
- Operator continuity over family names. A family name is a brand, and brands get retired and relaunched to shed the heat from a takedown. The operators, their hosting relationships, and their affiliate rosters carry over. Tracking the continuity underneath the rebrand is slower work than blocking a domain, and it is the work that actually survives the next takedown.
The honest assessment two years on is that the takedowns were worth doing and did real damage, and that the ecosystem is structurally built to absorb exactly that kind of damage. Both are true at once. Operation Endgame raised the cost of running the loader layer and put names in indictments, which matters. It did not end the loader layer, because the demand behind it never went anywhere. The families that came back came back leaner and faster to rebuild, and the useful place to watch them has moved from the infrastructure they burn through to the structure and tradecraft they keep. That is where our tracking sits now, and it is where we expect the next round of this to be fought.