Europol takes down 235 servers linked to Gootloader, CastleRAT and StealC
Original title: Europol Takes Down 235 Servers and 257 Domains Linked to Gootloader, CastleRAT, and StealC Malware
The Operation Endgame action recovered 6.4 million victim datasets and cleaned 681 websites used to deliver Gootloader.
Europol and international partners announced on November 12, 2026, that Operation Endgame disrupted cybercrime-as-a-service infrastructure supporting ransomware and data theft, covering 235 servers and 257 domains. Authorities reported 14 Gootloader servers and 218 domains, 120 CastleRAT servers and 39 domains, and 102 StealC servers. Those component counts total 236 servers, one more than the stated total, with no explanation given. Victim alerts will go through Have I Been Pwned and partner services.
Unconfirmed: Per-malware server counts total 236, one more than the stated 235, and the report does not explain the gap.
- Gootloader used fake legal documents on hacked WordPress sites and search poisoning.
- CastleRAT, known since 2025, supports keylogging, screen capture and clipboard monitoring.
- StealC steals passwords and saved login details used for fraud and further attacks.
- A June 2026 Europol action also targeted StealC with SocGholish and Amadey.
- WordPress owners are urged to rotate credentials, enable MFA and remove unknown accounts.
Impact: Credential theft, remote control and access used for ransomware
- 1.Change WordPress credentials, enable multifactor authentication and remove unknown accounts.
- 2.Patch vulnerabilities and keep WordPress sites updated to reduce reinfection.
- 3.Check Have I Been Pwned and listed partner services for exposed credentials.
- Products
- WordPress
- Malware
- GootloaderCastleRATStealC
From the original article
2 min read at cybersecuritynews.com
Europol and international partners have disrupted infrastructure linked to Gootloader, CastleRAT, and StealC, targeting malware services that support ransomware attacks and data theft. Announced on November 12, 2026, the latest Operation Endgame action covered 235 servers and 257 domains. Authorities also recovered 6.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.