TL;DR
- International police in Operation Endgame seized 235 servers and 257 domains used by Gootloader, CastleRAT, and StealC.
- Authorities identified about 6.4 million stolen logins on that infrastructure.
- Europol announced the action on November 12, with agencies from nine countries taking part.
- The takedown is a win, but stolen passwords and already-infected computers still need attention.
- Have I Been Pwned added 179,745 CastleRAT email addresses on November 13.
International police have taken down major parts of the criminal networks behind Gootloader, CastleRAT, and StealC. Europol announced the action on November 12 as the latest strike in Operation Endgame. Agencies from nine countries took part, including the FBI and other U.S. partners. Together they seized 235 servers and 257 domains. They also identified about 6.4 million stolen logins on that infrastructure.
Germany's Federal Criminal Police Office says those logins belonged to more than 40,000 victims. The suspects had been selling the stolen credentials for later attacks, including ransomware. No arrests were announced in this week's action. Dutch police say further work is underway against Gootloader's main suspect.
Each of the three tools played a different role. Gootloader is a loader. It often spread through fake legal documents placed on hacked WordPress sites. Criminals pushed those sites to the top of search results. Police took down 14 of its servers and 218 domains. They also cleaned malware from 681 infected websites. CastleRAT is a remote access Trojan first seen in 2025. It lets an attacker control an infected computer from a distance. Police seized 120 of its servers and 39 domains. StealC is an infostealer built to pull passwords and other stored access data from a machine. Police dismantled 102 of its servers. That follows an earlier takedown of StealC infrastructure in June.
This is a real win for the people and businesses those tools targeted. Taking the servers and domains offline cuts off a path that often leads to ransomware. The work is not finished for already-compromised machines.
Police warn that criminals may still have copies of the stolen logins. If malware remains on a computer, those criminals may also capture a new password after it is changed. The first job is to get the malware off the machine. Then change the passwords that were stored or typed on it. Sign out of other sessions on email, banking, and business accounts. Turn on multifactor authentication wherever it is offered.
People can also check whether a work or personal email appears in the CastleRAT data. Have I Been Pwned added those addresses on November 13. Europol provided the set. That listing covers 179,745 email addresses tied to CastleRAT infections. It does not include every login seized this week. Dutch police have a similar check at their Check your hack page. Ignore any email that claims to come from the police. Those messages often ask you to click a link. Dutch police say they do not send emails with links.
WordPress site owners should take a short extra pass. Change administrator passwords. Turn on multifactor authentication. Update WordPress, its themes, and its plugins.
Mabank businesses can call My I.T. Consultants at 903-675-5431 for help checking for leftover malware, resetting logins, and reviewing WordPress sites. Our office hours for hourly work are Monday through Friday from 7:00 a.m. to 6:00 p.m. Contract customers can reach us 24/7.
Want help with this at your business? See Cybersecurity on our Services page or contact My I.T. Consultants.
