Operation Endgame seizes Gootloader, CastleRAT and StealC servers
Original title: Operation Endgame malware takedown turns up over 6 million stolen logins
Police in nine countries and Europol seized 235 servers and 257 domains and recovered more than 6 million stolen logins.
Europol said the latest Operation Endgame action took infrastructure from the Gootloader, CastleRAT and StealC malware operations and recovered more than 6 million credentials stolen from infected computers. Suspects sold harvested logins that buyers used for further attacks, including ransomware. CastleRAT victim data will go to notification services including Have I Been Pwned. Gootloader infections began with fake legal documents on compromised websites, often WordPress, and 681 infected sites were cleaned.
Unconfirmed: Europol’s description of ransom payments and of how the stolen logins were used is not independently confirmed in the report.
- Gootloader lost 14 servers and 218 domains; CastleRAT 120 servers and 39 domains.
- StealC lost 102 servers, continuing action that began in June 2026.
- Europol links CastleRAT to encrypted data, crippled IT and ransom payments.
- StealC collected passwords, saved logins and digital identities for sale.
Impact: More than 6 million stolen logins recovered from infected computers
- 1.WordPress users should change credentials, enable multi-factor authentication and patch vulnerabilities.
- Products
- WordPress
- Malware
- GootloaderCastleRATStealC
- Organizations
- EuropolHave I Been Pwned
From the original article
1 min read at helpnetsecurity.com
Police in nine countries, working with Europol, took down servers behind the Gootloader, CastleRAT and StealC malware operations this week and recovered more than 6 million credentials stolen from infected computers. Europol announced the action as the latest round of Operation Endgame, the international campaign against the services that give ransomware gangs their way into a network.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.