Police seize Gootloader, CastleRAT and StealC servers and millions of logins
November 12: The Record says German investigators linked rebuilt StealC servers to Virtualine, seized by the FBI in October, and that about 6.4 million logins came from more than 40,000 victims, with no arrests announced.
Operation Endgame seized 235 servers and 257 domains and recovered millions of stolen logins; no arrests were announced.
Europol and police in nine countries, with Eurojust, dismantled infrastructure used by Gootloader, CastleRAT and StealC under Operation Endgame, seizing 235 servers and 257 domains. Authorities recovered more than 6 million stolen credentials that suspects sold for later attacks, including ransomware; several outlets report about 6.4 million datasets or logins, and The Record says they came from more than 40,000 victims. Reported family totals are 14 Gootloader servers and 218 domains, 120 CastleRAT servers and 39 domains, and 102 StealC servers; Cyber Security News notes those server counts add to 236. The Record says German police traced rebuilt StealC servers to Virtualine, a host the FBI seized in October, and that no arrests or charges were announced. CastleRAT alerts will go to Have I Been Pwned and other services, and 681 sites used to deliver Gootloader were cleaned.
- Partners included Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK and the US.
- A June 2026 action previously targeted StealC and restricted access to €41 million in cryptocurrency.
- Gootloader, active since 2020, spread via fake legal documents on compromised WordPress sites.
- CastleRAT, known since 2025, is a remote-access trojan; victim notices will use several platforms.
- People can check exposure at politie.nl/checkyourhack and haveibeenpwned.com.
Timeline
dated events in the reporting · oldest first- Nov 12, 2026Europol announces Endgame seizures targeting three malware operations · Cyber Security News
What each outlet adds
beyond the shared facts- The RecordVirtualine link, 40,000 victims, no arrests, and June €41 million
- Cyber Security NewsFamily server counts sum to 236, with no explanation
- BleepingComputerNames the nine participating countries
- Help Net SecurityBreaks out seized servers and domains by malware family
- CyberScoopEurojust role and Dutch NCSC among notification channels
Coverage
oldest first · one row per article · UTC- · 11h ago
Help Net SecurityFirst report
Operation Endgame seizes Gootloader, CastleRAT and StealC servers
Police in nine countries and Europol seized 235 servers and 257 domains and recovered more than 6 million stolen logins.
- · 10h ago
BleepingComputer
Police seize Gootloader, CastleRAT and StealC servers and domains
Authorities seized 257 domains and 235 servers and found more than 6 million stolen credentials.
- · 9h ago
DataBreaches.net
Police seize servers used by Gootloader, CastleRAT and StealC
Europol and partners in nine countries took down hundreds of servers and domains under Operation Endgame.
- · 8h ago
The Record
European police dismantle StealC servers for a second time
The wider action disrupted 235 servers and 257 domains and recovered copies of about 6.4 million stolen logins.
- · 8h ago
CyberScoop
Operation Endgame dismantles CastleRAT, Gootloader and StealC networks
Authorities seized 235 servers and 257 domains and identified credentials for 6.4 million victims.
- · 8h ago
Cyber Security News
Europol takes down 235 servers linked to Gootloader, CastleRAT and StealC
The Operation Endgame action recovered 6.4 million victim datasets and cleaned 681 websites used to deliver Gootloader.