Authorities in nine countries have seized 235 servers and 257 domains tied to the Gootloader, CastleRAT and StealC malware networks, securing data from 6.4 million victim datasets in the latest phase of Operation Endgame. Europol said the action targeted the cybercrime-as-a-service ecosystem that supplies criminal groups with malware, stolen credentials and access used in fraud, intrusions and ransomware attacks.
Law enforcement agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States worked with Europol, Eurojust and more than 30 public- and private-sector partners. The operation disrupted infrastructure supporting three different parts of the criminal supply chain: Gootloader’s malware delivery, CastleRAT’s remote access capabilities and StealC’s credential theft. Europol described Operation Endgame as the largest international effort focused on ransomware enablers.
Gootloader accounted for 14 seized servers and 218 domains. The loader was distributed through compromised WordPress sites and fake legal documents, then used to establish an initial foothold and deliver additional malware, including ransomware. The U.S. Department of Justice said Gootloader has infected at least 25,000 computers worldwide since 2018 and has been used against at least 44 U.S. victims, causing approximately $28.8 million in losses. Investigators also cleaned 681 infected websites, according to the Justice Department.
Authorities seized 120 servers and 39 domains associated with CastleRAT, a remote-access trojan first reported publicly in 2025, while 102 servers linked to StealC were taken down. StealC is an information stealer with dropper functionality that collects passwords, browser data and other credentials for resale or use in follow-on attacks. Investigators said the seized infrastructure contained more than six million stolen credentials and other victim data that criminals had accumulated and offered for sale.
The operation does not center on a single software vulnerability or a newly disclosed CVE; the affected systems were compromised through malware delivery, credential theft and abused web infrastructure. Organizations should nevertheless treat potentially exposed credentials as compromised, reset passwords that may have been reused, enable multifactor authentication and review authentication logs for suspicious access. WordPress administrators should update the core platform, plugins and themes, remove unused components and inspect sites for unauthorized files, accounts and redirects.
Authorities said victim information will be shared with notification and threat-intelligence organizations including Have I Been Pwned, the Shadowserver Foundation and the Dutch National Cyber Security Centre. The disclosures are intended to help individuals and organizations determine whether credentials taken by the malware networks require immediate replacement.
