Threats · 11h ago
Operation Endgame seized infrastructure, not stolen logins Europol says police in nine countries seized 235 servers and 257 domains in the latest Operation Endgame action against Gootloader, CastleRAT and StealC, identifying 6.4 million stolen credentials. Authorities also cleaned 681 infected websites; victim data is to be shared with notification services including Have I Been Pwned and the Shadowserver Foundation.
Gootloader spread through fake legal documents hosted on compromised sites, including hacked WordPress sites; people who downloaded them infected their computers. Malware on infected machines could collect saved passwords and digital identities, which operators sold to buyers for fraud and further attacks, including ransomware.
Taking down servers and domains disrupts the malware operations, but does not invalidate credentials already copied or sold. If an organization’s users were infected, those logins may still open accounts or support follow-on fraud after delivery sites are cleaned up. The operation does not establish which credentials remain active or whether buyers have used them.
Timeline Sources 7 sources covering this story
Shadowserver Foundation Nov 13
CastleRAT Historical Bot Infection Special Report (Stolen Credentials)
This latest action targeted the Gootloader, CastleRAT, and StealC cybercrime-as-a-service families.
The Record from Recorded Future Nov 13
DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018
officials detailed the history and impact of the Gootloader ransomware.
The Hacker News Nov 13
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins
Operation Endgame seized 235 servers, 257 domains, and 6.4 million stolen logins in a takedown targeting Gootloader, CastleRAT, and StealC.
SecurityWeek Nov 13
Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure
Investigators seized 235 servers and 257 domains, along with 6.4 million victim credentials as part of Operation Endgame.
CyberScoop Nov 12
International operation dismantles malware networks, exposes 6.4 million stolen credentials
Europol and nine countries dismantled CastleRAT, Gootloader, and StealC malware networks in Operation Endgame, exposing 6.4 million stolen credentials.
BleepingComputer Nov 12
Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations.
Help Net Security Nov 12
Operation Endgame malware takedown turns up over 6 million stolen logins - Help Net Security
Operation Endgame malware takedown hits Gootloader, CastleRAT and StealC, seizing 235 servers and finding over 6 million stolen credentials.
Part of the PlainSec briefing for 2026-11-14
Editions Related stories Threats · 11h ago
Operation Endgame seized infrastructure, not stolen logins Europol says police in nine countries seized 235 servers and 257 domains in the latest Operation Endgame action against Gootloader, CastleRAT and StealC, identifying 6.4 million stolen credentials. Authorities also cleaned 681 infected websites; victim data is to be shared with notification services including Have I Been Pwned and the Shadowserver Foundation.
Gootloader spread through fake legal documents hosted on compromised sites, including hacked WordPress sites; people who downloaded them infected their computers. Malware on infected machines could collect saved passwords and digital identities, which operators sold to buyers for fraud and further attacks, including ransomware.
Taking down servers and domains disrupts the malware operations, but does not invalidate credentials already copied or sold. If an organization’s users were infected, those logins may still open accounts or support follow-on fraud after delivery sites are cleaned up. The operation does not establish which credentials remain active or whether buyers have used them.
Timeline Sources 7 sources covering this story
Shadowserver Foundation Nov 13
CastleRAT Historical Bot Infection Special Report (Stolen Credentials)
This latest action targeted the Gootloader, CastleRAT, and StealC cybercrime-as-a-service families.
The Record from Recorded Future Nov 13
DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018
officials detailed the history and impact of the Gootloader ransomware.
The Hacker News Nov 13
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins
Operation Endgame seized 235 servers, 257 domains, and 6.4 million stolen logins in a takedown targeting Gootloader, CastleRAT, and StealC.
SecurityWeek Nov 13
Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure
Investigators seized 235 servers and 257 domains, along with 6.4 million victim credentials as part of Operation Endgame.
CyberScoop Nov 12
International operation dismantles malware networks, exposes 6.4 million stolen credentials
Europol and nine countries dismantled CastleRAT, Gootloader, and StealC malware networks in Operation Endgame, exposing 6.4 million stolen credentials.
BleepingComputer Nov 12
Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations.
Help Net Security Nov 12
Operation Endgame malware takedown turns up over 6 million stolen logins - Help Net Security
Operation Endgame malware takedown hits Gootloader, CastleRAT and StealC, seizing 235 servers and finding over 6 million stolen credentials.
Part of the PlainSec briefing for 2026-11-14
Editions Related stories