A Surrey resident has been arrested as part of a major international operation targeting cybercriminals who used hacked computers to spread malware and make money illegally. Police say the man operated a network of thousands of infected devices capable of stealing data, spying through webcams, mining cryptocurrency, and more.

The arrest ties back to Operation Endgame, a global effort that began in May 2024 and took down some of the world’s biggest malware tools, including Smokeloader, Bumblebee, and IcedID. Those tools were used to secretly install malware on victims’ machines. Now, authorities are going after the people who paid to use them.

“This individual had purchased this type of information and access and was using it to exploit for themselves,” said Supt. Adam MacIntosh, who leads the Cyber and Financial Investigation Teams in BC’s Pacific Region.

Police explained that the man wasn’t running the whole operation. Instead, he was a customer of what’s called a “pay-per-install” botnet. Basically, he paid for access to already-hacked computers and used them for his own gain.

“Investigations revealed that botnet access was purchased for a range of purposes, including keylogging, webcam access, ransomware deployment, cryptomining and more. Some even resold this access at a profit,” Europol’s said in a press release.

Authorities were able to identify customers like him using a seized database recovered during the original Operation Endgame takedown.
Cybersecurity expert Chester Wisniewski from Sophos said this shows even lower-level criminals are now in law enforcement’s sights.

“This arrest here in BC in particular … kind of sends a message to the customers that you’re not off the hook either.” He added, “We have to increase the friction to make these crimes more difficult. And certainly, wondering if the police are going to knock on the door at any moment is a good deterrent.”

Operation Endgame is far from over. Authorities across North America and Europe are continuing to follow leads, and more arrests are expected.