Follow us on Google News
Europol and international law enforcement agencies have disrupted criminal infrastructure linked to three major malware networks, Gootloader, CastleRAT and StealC, in the latest phase of Operation Endgame, a coordinated campaign targeting cybercrime operations involved in data theft and ransomware attacks.
The operation resulted in action against hundreds of servers and 257 domains used by cybercriminals to distribute malicious software and facilitate further attacks. Authorities also identified approximately 6.4 million sets of stolen victim credentials within the criminal infrastructure.
The coordinated crackdown involved law enforcement agencies and private-sector partners from several countries, with Europol providing cyber intelligence, financial tracing and assistance in identifying affected victims.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How Did Authorities Disrupt Gootloader, CastleRAT and StealC?
The operation targeted three malware families that enabled criminals to gain unauthorised access to computer systems, steal sensitive information and support subsequent cyberattacks.
Gootloader, a malware loader, was distributed through compromised websites, including hacked WordPress platforms. Attackers used fake legal documents to persuade visitors to download malicious files, which could infect their computers and facilitate additional attacks.
According to Europol, authorities took down 14 servers and 218 domains associated with Gootloader. Another 681 compromised websites were remediated during the operation.
CastleRAT, a remote access trojan identified in 2025, allowed attackers to control infected computers remotely.
The malware used techniques designed to complicate detection and could be deployed in different environments. Its use was linked to attacks involving encrypted data, disrupted IT systems and ransom demands against affected organisations.
Law enforcement agencies seized 120 servers and 39 domains connected to CastleRAT. Information obtained during the operation is being used to notify potential victims.
The third target, StealC, was designed primarily to extract passwords, stored login information and digital identities from compromised computers.
The stolen information could subsequently be traded or used for fraudulent activities and additional cyberattacks.
Authorities reported dismantling 102 servers linked to StealC, continuing earlier efforts against the malware network in June 2026.
What Happened to the 6.4 Million Stolen Credentials?
During the operation, investigators identified approximately 6.4 million sets of stolen victim credentials stored within infrastructure used by cybercriminals.
According to Europol, the information had been obtained from infected computers and could have been sold or reused in further attacks, including ransomware incidents.
The identification of these records will enable participating organisations to alert affected individuals and businesses about potentially compromised credentials.
Victim information is being shared through services and organisations including Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and the Netherlands National Cyber Security Centre.
These services can help identify exposed accounts and notify users whose credentials may have been compromised.
The operation has particular relevance for administrators of WordPress websites because Gootloader relied partly on compromised websites to distribute malicious files disguised as legitimate documents.
Users and website administrators have been advised to update compromised credentials, enable multi-factor authentication and install available security patches.
The discovery of stolen credentials does not necessarily mean that every affected account was subsequently misused. However, the information could potentially support additional criminal activity if left unsecured.
Which Countries Participated in Operation Endgame?
The latest action formed part of Operation Endgame, an international law enforcement initiative aimed at disrupting malware distribution services and other criminal infrastructure used to facilitate ransomware attacks.
Europol’s European Cybercrime Centre supported the coordinated action through intelligence sharing, financial investigations and victim notification efforts.
Eurojust assisted judicial authorities with exchanging information and coordinating investigative measures across jurisdictions.
Participating authorities included law enforcement agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States.
The US participants included the Federal Bureau of Investigation, the Department of Justice, the Defense Criminal Investigative Service and the Army Criminal Investigation Division.
The operation also involved private-sector cybersecurity partners working alongside law enforcement agencies.
Operation Endgame has brought together more than 30 public and private partners to target criminal services that enable malware infections, data theft and ransomware attacks.
The latest disruption follows earlier coordinated action in June 2026 against malware networks including SocGholish, Amadey and StealC.
By dismantling infrastructure linked to Gootloader, CastleRAT and StealC, authorities have targeted services used to compromise computers and distribute stolen information.
The recovery of millions of victim credentials is expected to support notifications to affected users and organisations, while the removal of criminal infrastructure is intended to limit the ability of these malware networks to support further attacks.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
