Europol, backed by partners including Eurojust and national law enforcement agencies, has launched a major disruption of malware infrastructure linked to three prolific threats: Gootloader, CastleRAT, and StealC. On November 12, 2026, authorities announced that they seized 235 servers and 257 domains, and collected more than 6.4 million compromised victim records. This action is part of “Operation Endgame,” which aims to undercut the cybercrime-as-a-service operations fueling ransomware and data theft.
The Malware Campaigns: Tactics and Takedowns
Gootloader operates by tricking users into downloading malicious JavaScript and documents disguised as legitimate legal or business files. These are often hosted on compromised websites, including hijacked WordPress sites. The takedown neutralized 14 servers, dismantled 218 domains, and cleaned up 681 infected sites. It was shown that Gootloader’s search poisoning tactic sends unsuspecting victims toward harmful downloads under the guise of genuine search results and forum pages.
CastleRAT, active since 2025, grants attackers total remote control over infected systems—enabling screen capture, keylogging, and monitoring of clipboards. Law enforcement removed 120 servers and 39 domains tied to this malware strain. The disruption aims to cut off the mechanisms attackers use to surveil and infiltrate systems long before ransomware is deployed.
StealC focuses on stealing saved passwords, login credentials, and identity information to enable fraud and further cyber attacks. Authorities dismantled 102 servers connected to StealC as part of the operation. This crackdown builds on earlier efforts—such as law enforcement actions in June 2026 targeting StealC alongside Amadey and SocGholish—demonstrating sustained pressure on credential-stealing malware networks.
Victim Assistance and Hardening Measures
Affected individuals and organizations can expect notifications facilitated through platforms such as Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, Shadowserver, and NL-NCSC. Europol played a central role in intelligence gathering and financial tracing, while Eurojust coordinated judicial actions across borders.
In parallel, cybersecurity experts are pushing WordPress site administrators to ramp up defenses: change passwords, enable multifactor authentication, patch known vulnerabilities, and eliminate unknown accounts. Despite seizure of infrastructure, infection risks persist unless exposed systems are fully sanitized and secured.
It’s worth noting that the reported number of servers for all three malware families sums to 236 servers—one more than the headline figure of 235—while the domain counts match exactly. The discrepancy hasn’t been clarified publicly, but highlights the complex tracking required in large-scale cyber operations.
While this operation severely disrupts the support infrastructure behind Gootloader, CastleRAT, and StealC, long-term impact depends on whether malware operators can rebuild their networks. Vigilance from organizations and users—combined with international policing efforts—will be key to preventing resurgence.
