Europol announced on November 12 that a new phase of Operation Endgame has seized 235 servers and 257 domains used by the Gootloader, CastleRAT and StealC malware operations. Investigators also found about 6.4 million sets of stolen victim credentials on the infrastructure.
Agencies and Infrastructure Hit in the Latest Endgame Phase
Europol and Eurojust coordinated authorities from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, working with more than 30 public and private partners.
The seizures split unevenly across the three malware families. CastleRAT, a remote access trojan known since 2025, lost 120 servers and 39 domains. Gootloader lost 14 servers and 218 domains, and 681 infected websites were cleaned. StealC, an infostealer, lost 102 servers. No arrests, cryptocurrency seizures or charges have been announced.
Gootloader: Fake Legal Documents on Hacked WordPress Sites
Gootloader spreads through fake legal documents planted on hacked WordPress sites and serves as an access broker’s entry point for ransomware. The US Department of Justice, through the District of Colorado, said the loader has infected at least 25,000 computers since 2018 and was used in at least 44 US ransomware attacks that caused about $28.8 million in losses. Victims included members of the Defense Industrial Base.
Under court authorization, the FBI wiped the malware from more than 100 servers, including hijacked WordPress sites.
StealC Rebuilt on Virtualine Hosting, Then Hit Again
German authorities said the StealC operators rebuilt their infrastructure on the Virtualine bulletproof hosting provider, which the FBI seized in October. This is the second StealC takedown this year; an earlier Endgame phase in June hit StealC and Amadey with 326 servers and 142 domains, and also targeted SocGholish.
Millions of Stolen Credentials Funnelled Back to Victims
Investigators found roughly 6.4 million victim credential datasets on the seized systems. One report puts the number of victims above 40,000. The data is being added to Have I Been Pwned and passed to Shadowserver, DIVD, NCSC-NL and other organizations that notify affected people and network owners.
Where Victims Can Check Their Exposure
Authorities directed victims to haveibeenpwned.com and politie.nl/checkyourhack to see whether their credentials appear in the seized data. WordPress site owners were urged to rotate credentials, enable multi-factor authentication and patch their installations, since compromised sites were the delivery channel for Gootloader.
What the Repeat Takedowns Show About Malware-as-a-Service
The return of StealC within months of its first disruption shows how quickly operators rebuild when bulletproof hosting stays available. Taking out the hosting provider in October and the rebuilt servers in November hit the supply chain behind the malware, rather than one deployment of it.
The three tools also feed one another’s economy. Infostealers such as StealC produce credentials, loaders such as Gootloader hand access to ransomware crews, and remote access trojans such as CastleRAT give operators persistent control. Removing infrastructure across all three at once reduces the number of places a displaced operator can move to.
The absence of arrests means the people behind these tools remain at large, and the pattern of earlier phases suggests they can reconstitute. The long-run measure of this phase will be whether the 681 cleaned WordPress sites stay clean and whether the notified victims rotate credentials before the stolen data is used.
Where the 257 Seized Domains Sit Across the Three Malware Families
The domain figures show where each operation concentrated its infrastructure. Gootloader accounts for 218 of the 257 seized domains but only 14 servers, a ratio consistent with a loader that depends on many disposable web addresses to reach victims through compromised WordPress sites. CastleRAT and StealC lean the other way, with 120 and 102 servers respectively behind far fewer domains.
What the Mixed Public and Private Partnership Added
More than 30 public and private partners joined the agencies in the operation. Several of them, including Have I Been Pwned, Shadowserver, DIVD and NCSC-NL, are the bodies now receiving the stolen credential datasets so that individual victims and network owners can be alerted. That division of labor separates the law-enforcement action on servers from the downstream notification work, which reaches far more people than the original seizure warrants.
