THE HAGUE, November 13, 2026 — Europol and international partners disrupted 235 servers and 257 domains linked to Gootloader, CastleRAT, and StealC malware on November 12, 2026, in the latest Operation Endgame strike. Authorities recovered 6.4 million victim datasets from the criminal infrastructure.
The Shift Is Infrastructure, Not Just Payloads
The trend underneath Operation Endgame is a move away from chasing ransomware gangs and toward dismantling the malware-as-a-service supply chain that feeds them. Europol’s latest action hit the loaders, remote access trojans, and infostealers that give ransomware operators their initial foothold. Cybercrime-as-a-service models supply tools or access that other attackers use to breach networks and deploy ransomware, according to Europol. Removing those servers and domains disrupts several stages of that chain rather than targeting only the final payload.
Gootloader and CastleRAT: The Affiliate Numbers
Gootloader lost 14 servers and 218 domains, while responders cleaned 681 infected WordPress websites. The malware draws victims through fake legal documents hosted on compromised sites, turning an ordinary search for a contract into a malicious JavaScript download. Its role as a loader makes it a critical handoff point for ransomware operators who use the access to prepare later attacks.
CastleRAT, a remote access trojan first known since 2025, lost 120 servers and 39 domains. The malware lets attackers control infected computers, deploy ransomware, and harvest data through keylogging, screen capture, and clipboard monitoring. StealC infrastructure lost 102 servers, continuing pressure that began with a June 2026 operation targeting the same infostealer alongside SocGholish and Amadey.
How Stolen Credentials Feed the Ransomware Machine
The 6.4 million recovered datasets illustrate what analysts watch closely: credentials are the currency that turns a single infection into a network breach. Suspects sold credentials harvested from victims’ machines, and buyers used them for further attacks, ransomware among them. StealC targets passwords, saved login details, and digital identities, with stolen data feeding fraud and follow-on intrusions. CastleRAT victim data will be sent to notification services including Have I Been Pwned, the Dutch Institute for Vulnerability Disclosure, and the Dutch police’s CheckjeHack.
Assessing Rapid Reconstitution
The published malware figures total 236 servers, one more than the overall figure of 235, a discrepancy without a published explanation. That gap matters when assessing the operation’s reported scale. Affiliate networks have rebuilt infrastructure after previous takedowns; the June action against StealC did not prevent its reappearance in this latest sweep. Nine countries participated in the current action, but the malware-as-a-service model is designed for resilience. Operators can spin up new command-and-control layers, register fresh domains, and recruit new affiliates faster than legal processes allow seizures.
What 6.4 Million Datasets Means for Security Teams
The volume of recovered credentials forces a practical response. Europol is urging WordPress users to change credentials, enable multi-factor authentication, and patch vulnerabilities. Administrators should apply updates to WordPress, its plugins, and themes, and investigate unexpected downloads appearing on their sites. People who receive an alert from notification services should change affected passwords from a clean device, replace reused passwords on other accounts, and enable multi-factor authentication. If an alert identifies a device as infected, clean it before signing in again.
Sources
- Europol Takes Down 235 Servers and 257 Domains Linked to Gootloader, CastleRAT, and StealC Malware
- Europol
- Operation Endgame malware takedown turns up over 6 million stolen logins – Help Net Security
- 354 Dark Web Vendors And Buyers Arrested In Europol-Coordinated Global Crackdown
- DOJ's Operation TorNado Arrests 354 And Seizes $234 Million In Cash And Crypto
- Police recover 6.4 million stolen records in malware takedown
Photo: Vysotsky (CC BY-SA 4.0)
