We review vendors based on rigorous testing and research, and also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.

Learn more

Advertising Disclosure

FBI Exposes DanaBot Malware Gang Behind Global Cyber Heist

Image by Growtika from Unsplash

FBI Exposes DanaBot Malware Gang Behind Global Cyber Heist

Reading time: 2 min

Last Updated: May 26, 2025

Written by Kiara Fabbri Multimedia Journalist
Fact-Checked by Sarah Frazier Content Manager

The FBI has charged 16 people linked to DanaBot, a malware that infected 300,000+ computers and stole over $50 million worldwide.

In a rush? Here are the quick facts:

DanaBot infected over 300,000 computers globally.
Malware stolen over $50 million from victims.
Spy variant targeted government and military systems.

According to unsealed indictments, those involved performed various roles, including development, marketing, and customer support functions.

DanaBot exists in two distinct versions. The dark web offers this rental model for up to $4,000 which includes technical support and software tools, as reported by The Register. The malware steals banking and cryptocurrency login information from victims after it captures their keystrokes, screenshots, and network data through installation on their computers.

The second version of the malware operates as a spy tool which is not available for rental purposes. The malware system targets military and diplomatic and government networks by recording desktop screens and logging keyboard inputs and capturing video streams.

The Register reported that Special Agent Elliott Peterson from the FBI confirmed that multiple banks suffered losses exceeding millions of dollars because of DanaBot and the total stolen amount could reach $50 million.

The takedown effort is part of “Operation Endgame II,” a global campaign to dismantle botnets. FBI Special Agent Rebecca Day said, “Today’s announcement represents a significant step forward in the FBI’s ongoing efforts to disrupt and dismantle the cyber-criminal ecosystem that wreaks havoc on global digital security,” as reported by The Register

The Register reports that most DanaBot servers have been taken offline. The remaining two active servers operate from Alibaba’s hosting platform.

Operation Endgame displays a countdown on its website which suggests the complete shutdown might occur during this week.

Kiara Fabbri

Written by: Kiara Fabbri

Hi, I’m Kiara Fabbri a Tech News Writer at WatchEverywhere. I'm a multimedia journalist with a keen interest in innovative and immersive news storytelling. Fluent in three languages—Italian, English, and Spanish—I'm deeply engaged in all facets of news reporting. I am currently undertaking a Ph.D. exploring VR applications in journalism. Following my studies in psychology (BSc) and political psychology (MSc), I embarked on a three-year journey across South America. During this time, I undertook a 4000 km solo bicycle trip from Chile to Brazil. There, I camped, cooked on the road, and volunteered in various facilities. It was during these travels that I discovered my passion for journalism. Subsequently, I pursued a Master's program in journalism innovation and enterprise. My career in journalism has seen me produce VR immersive experiences covering a range of topics. These include documenting an Anti Militaristic raid of a NATO Base, life in the Brazilian Favelas, the recent violent protest clashes in Buenos Aires and finally social projects run by Skaters in the Argentinian ghettos. In addition to my journalistic endeavours, I also practice parkour, a discipline I have cultivated over several years now. I love to make the most of this skill in my journalistic style; for example, it has enabled me to capture dynamic footage from heights during the recent violent clashes in Buenos Aires. There, I scaled heights and employed a long stick on my camera to create aerial 360° views. Through my dedication to pushing the boundaries of journalism, I am committed to amplifying voices, sparking meaningful conversations, and driving positive change in the world.

Did you like this article? Rate it!

I hated it I don't really like it It was ok Pretty good! Loved it!

We're thrilled you enjoyed our work!

As a valued reader, would you mind giving us a shoutout on Trustpilot? It's quick and means the world to us. Thank you for being amazing!

Rate us on Trustpilot

4.00 Voted by 1 users

Title

Your email Please enter a valid email address.

Comment

Thanks for your feedback

Share & Support

WatchEverywhere is reader-supported so we may receive a commission when you buy through links on our site. You do not pay extra for anything you buy on our site — our commission comes directly from the product owner. Some providers are owned by our parent company. Learn moreWatch Everywhere was established in 2018 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, Intego and Private Internet Access which may be ranked and reviewed on this website. The reviews published on Watch Everywhere are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article..