An international law enforcement effort dubbed Operation Endgame has successfully dismantled infrastructure used by three major malware tools—Gootloader, CastleRAT, and StealC—and confiscated approximately 6.4 million stolen login credentials tied to over 40,000 individual victims. The takedown involved seizing hundreds of servers and domains. This operation marks one of the most significant recent disruptions against malware-driven password theft and ransomware schemes.
What Was Targeted: Gootloader, CastleRAT, StealC
Gootloader, a notorious loader malware, infects computers—often through fake legal documents placed on compromised websites—using SEO poisoning to boost visibility in search results. Once deployed, it serves as a gateway for installing additional malicious tools, especially ransomware. Since 2018, Gootloader has infected at least 25,000 computers globally, causing roughly $28.8 million in losses in the U.S. alone. German authorities report that infections could number in the millions since its expanded activity from 2020.
CastleRAT is a remote access trojan, known for enabling full control over compromised systems. Its infrastructure—spanning domains and servers—was dismantled in this operation.
StealC operates as an infostealer, snatching passwords and login data for resale or misuse. It was previously disrupted in June but relit its operations through new infrastructure, even using bulletproof hosting services aimed at evading takedowns. Authorities have now shut down its servers and hosting platforms.
The Scope of the Takedown & Victim Impact
Authorities seized 235 servers and 257 domains across all three malware platforms. Specifically—14 servers and 218 domains tied to Gootloader were shut down, and over 680 websites compromised by Gootloader had backdoors removed and access revoked. CastleRAT saw 120 servers and 39 domains dismantled. StealC’s infrastructure, already modified since its last disruption, was also taken offline. Key bulletproof hosting service Virtualine/Omegatech, used by StealC, was seized in late October.
As part of the operation’s broader impact, 6.4 million stolen login credentials were recovered, affecting more than 40,000 victims. Victims now risk ongoing credential exposure if malware remains on infected devices. In parallel, authorities have made stolen data available via services like Have I Been Pwned and Shadowserver, and advice has been issued to affected individuals and organizations.
Remediation & Guidelines for Site Owners
WordPress site owners—and others—are urged to take swift action: change admin passwords to strong, unique ones of at least 12 characters; enable multi-factor authentication; purge unknown user accounts; remove any backdoor scripts; keep WordPress installations, themes, and plugins updated; and restrict wp-admin access to trusted IPs. These measures helped restore over 680 Gootloader-infected sites after backdoor removal.
Authorities also caution that emails claiming to be sent by police containing links to data-checking services are fake. Real notices never include direct links. Victims are encouraged to use official portals such as “Check your hack,” where entering an email reveals whether credentials were compromised.
No arrests have been reported so far as part of this week’s takedown. Parallel investigations continue. The Netherlands, for example, has intensified its probe into individuals tied to Gootloader’s operations.
This effort falls under Operation Endgame, a concerted international campaign aimed at dismantling malware infrastructure used in intrusion, credential theft, and ransomware. Supporting agencies include Germany’s BKA, Europol, and U.S. partners.
Authority disclosures reveal that even after infrastructure is seized, ongoing risks persist: malware on infected machines can still transmit credentials. Accordingly, victim notification and cleanup efforts are being coordinated through governmental cybersecurity bodies, ISPs, CSIRTs, and nonprofit partners.
What this means: Operation Endgame delivers a major blow to malware forums’ supply of stolen credentials and access tools. But the real test lies ahead. Are victims doing enough to purge infections and harden defenses? Infrastructure takedowns buy time—but without sustained awareness, strong hygiene, and systemic security reforms, the door stays open for the next wave of loader- and stealer-based campaigns.
