Europol announced on November 12, 2026 (local time) that, working with law enforcement agencies in other countries, it has dismantled the criminal infrastructure used to distribute and operate the Gootloader, CastleRAT and StealC malware. The action is the latest strike in the international operation known as Operation Endgame and covered 235 servers and 257 domains. According to the announcement, roughly 6.4 million sets of victim credentials were found on the seized infrastructure.
235 Servers and 257 Domains Were Seized
According to the announcement, in an operation carried out during the week of the release, law enforcement seized 235 servers and 257 domains, dealing a heavy blow to the distribution networks of the three malware families. Europol says these were actioned by law enforcement together with private parties.
The breakdown by malware family is as follows.
| Malware | Type | Servers | Domains | Other |
|---|---|---|---|---|
| Gootloader | Dropper/loader | 14 | 218 | 681 infected websites remediated |
| CastleRAT | Remote access trojan (RAT) | 120 | 39 | Victim data shared for alerts |
| StealC | Stealer with dropper function | 102 | Not stated | Continuing efforts from June 2026 |
The per-family server counts add up to 236, one more than the overall figure of 235. The announcement does not explain the difference. It also does not say whether any arrests or searches took place, nor does it give a figure for losses.
The Headline Says 6.4 Million Credentials, the Body Says Over 6 Million
The headline of the announcement puts the number of victim datasets secured at 6.4 million. The body text, meanwhile, says that over 6 million victim credentials were identified in the infrastructure owned by the criminals and seized by the authorities.
The data will be made available through several notification services and organizations in order to alert victims whose credentials were stolen by CastleRAT. The announcement names seven: HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC. It does not say when the data will become available.
All Three Serve as Entry Points for Intrusion or Data Theft
Gootloader is what is called a dropper/loader, a program used to deliver other malware. According to the announcement, it enabled unauthorized access to computer systems by distributing fake legal documents through compromised websites. Victims who downloaded the documents became infected, often via hacked WordPress sites.
CastleRAT is a remote access trojan (RAT) known since 2025. The announcement says it featured a modern technical architecture, could be deployed flexibly, and employed mechanisms that made its detection difficult. Its use reportedly led to the encryption of numerous data sets, the crippling of whole IT systems, and ransom payments.
StealC is a stealer, malware that extracts information, with a dropper function. It spread through multiple attack vectors and extracted passwords, stored access data, and digital identities. The stolen information was used for data trading and fraud, the announcement says.
The Action Follows a June Strike Under Operation Endgame
The official Operation Endgame website carries a Europol announcement dated June 24, 2026, covering action against the SocGholish, Amadey and StealC networks. The dismantling of 102 StealC servers is positioned as a continuation of the efforts that began in June.
The announcement says the latest operation targeted "cybercrime-as-a-service" models, in which the tools for cybercrime are offered as a service. The full text of the announcement is available on the official Operation Endgame website.
WordPress Users Are Urged to Update Credentials and Enable Multi-Factor Authentication
The announcement urges WordPress users to update credentials, enable multi-factor authentication, and patch vulnerabilities. The reason given is that Gootloader infections often took place via hacked WordPress sites.
As of this writing, the announcement contains no guidance specific to users in Japan. It also does not indicate when notifications to victims will begin or how far they will extend.
Our Take
Taking 235 servers and 257 domains offline at once likely deprives attackers who rely on these three malware families of their footing for the time being. Passing the stolen credentials to notification services is also a welcome step, in the sense that it gives victims more ways to find out for themselves.
That said, the announcement does not mention any arrests, and the operators may resume their activity on other infrastructure. The fact that StealC was targeted again after June suggests that a single takedown was not enough to stop it.
Even so, if victim notification advances with each seizure, users will have more room to limit the damage on their own side. In our view, the basic measures of not reusing passwords and setting up multi-factor authentication remain the most reliable, whatever the use case.
Summary
Europol and law enforcement agencies in other countries seized 235 servers and 257 domains underpinning Gootloader, CastleRAT and StealC, and secured roughly 6.4 million sets of victim data. The move matters to people who run sites on WordPress and to users concerned about leaked credentials. The victim data is to be provided through notification services, but no start date has been given.
