Europol takes down 235 servers used by the Gootloader, CastleRAT and StealC malware

Europol and its international partners have dismantled the infrastructure of the Gootloader, CastleRAT and StealC malware, with 235 servers and 257 domains taken down by law enforcement together with private companies, according to the Operation Endgame statement published on November 12.

According to Europol, Gootloader distributed fake legal documents from compromised websites, often WordPress sites; in this action 14 of its servers and 218 domains were taken down and 681 infected websites were cleaned. For CastleRAT, a remote access trojan known since 2025 whose use led to data encryption and ransom payments, 120 servers and 39 domains were seized. For StealC, a program that steals passwords and digital identities, 102 servers were dismantled, continuing the action of June 2026.

Europol says more than 6 million victim credentials were identified in the infrastructure seized this week, which the suspects sold for later use in other attacks, such as ransomware attacks. Victim data will be made available on platforms such as HaveIBeenPwned, and Europol urges WordPress users to change their credentials, enable two-factor authentication and apply patches.

According to BleepingComputer, law enforcement from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States took part in this phase. Europol did not report arrests in this phase in the statement read.