Europol disrupts Gootloader, CastleRAT and StealC infrastructure
Original title: Europol Dismantles Three Major Malware Networks, Seizes 235 Servers and 6.4 Million Stolen Records
Authorities seized servers and domains and recovered 6.4 million victim datasets, which they will use for notifications.
Europol and partners disrupted infrastructure for Gootloader, CastleRAT and StealC on November 12, 2026, under Operation Endgame. The action targeted cybercrime-as-a-service used for initial access, remote control and credential theft that can feed ransomware. Europol reported action against 235 servers and 257 domains and recovery of 6.4 million victim datasets, without claiming every operator was arrested. Victim data will be shared for notifications through services including Have I Been Pwned and Shadowserver.
Unconfirmed: Europol's 235-server total does not match the 14, 120 and 102 figures, which add to 236, and 6.4 million datasets may not equal distinct people.
- Gootloader: 14 servers, 218 domains and 681 remediated websites.
- CastleRAT: 120 servers and 39 domains seized; victim notices planned.
- StealC: 102 servers dismantled, extending a June 2026 disruption.
- Nine countries took part, including the US, UK, Germany and the Netherlands.
- WordPress admins were urged to reset credentials, enable MFA and patch.
Impact: Stolen credentials, remote access and data used for ransomware
- 1.WordPress administrators should change credentials, enable multifactor authentication and patch vulnerabilities.
- 2.Expect victim notifications via Have I Been Pwned, DIVD, Shadowserver and similar services.
- Products
- WordPress
- Malware
- GootloaderCastleRATStealC
From the original article
2 min read at gbhackers.com
Europol and international partners have disrupted infrastructure supporting Gootloader, CastleRAT, and StealC in the latest Operation Endgame action, targeting services that enable ransomware deployment, remote access, and credential theft. Authorities reported action against 235 servers and 257 domains, and recovered 6. 4 million victim datasets from criminal infrastructure.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.