Europol's Endgame strike hits Gootloader, CastleRAT and StealC

Police in nine countries have taken down infrastructure behind three malware services, Gootloader, CastleRAT and StealC, in the latest phase of Operation Endgame. Europol said on Thursday that law enforcement and private partners took action against 235 servers and 257 domains, and found more than 6 million stolen victim credentials on the seized systems. Europol did not announce any arrests.

The three tools were sold or rented to other criminals, Europol says, and were used to break into computers, steal data and set up ransomware attacks. The seized credentials had been taken from infected machines and were being sold on for use in further attacks.

What was taken down

Europol gives these figures for each service:

• Gootloader, a loader spread through fake legal documents on compromised websites, often hacked WordPress blogs: 14 servers and 218 domains taken down, and 681 infected websites cleaned up.
• CastleRAT, a remote access trojan known since 2025 that Europol links to ransomware attacks in which companies paid ransoms: 120 servers and 39 domains seized.
• StealC, an information stealer that also drops other malware: 102 servers dismantled, following a June 2026 action against the same malware.

The per-service server counts add up to 236, one more than the total Europol gives. The domain counts match its total of 257.

What victims should do

Europol says victim data will be shared through Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and the Dutch NCSC, so that people whose credentials were stolen by CastleRAT can be alerted. It urges WordPress site owners to change their passwords, turn on multi-factor authentication and patch their sites, since Gootloader relied on hacked blogs to host its lures. The Operation Endgame site carries the operation's public messages and videos.

Five years of tracking Gootloader

The researcher who has run the Gootloader tracking account since 2021 published an account of the hunt on the day of the takedown. They first found the malware on company machines in May 2021 and traced it to a network of compromised WordPress blogs whose hidden posts linked to each other to climb Google's rankings, a technique Sucuri had described in 2018. They later cracked the blogs' backdoor, watched infected companies' domains reach the blogs they had taken over, and passed what they found to police in several countries.

The researcher says they handed their research to Operation Endgame after DEF CON in August 2025. When Gootloader returned in November 2025, they found the attackers' new blogs and worked with Google Safe Browsing, Cloudflare and the registrar Gname to take them down, and says Gootloader has been dormant since then.

What is not known

Europol has not named any suspects, said whether arrests were made, or said when the servers were seized beyond the fact that it happened this week. It has not said how many of the 6 million credentials came from each of the three services.