International law enforcement just delivered another blow to the cybercrime-as-a-service economy. On November 12, 2026, Europol and Eurojust announced the latest phase of Operation Endgame, a sweeping multi-country campaign that seized 235 servers and 257 domains tied to three major malware families: Gootloader, CastleRAT, and StealC. Authorities also recovered approximately 6.4 million stolen credential datasets from the dismantled infrastructure and remediated 681 compromised websites.
The operation involved law enforcement agencies from nine countries — Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States — with private-sector partners helping identify, block, and seize criminal infrastructure.
What Is Gootloader and Why Does It Matter?
Gootloader is a malware loader that has been active since at least 2020. Its primary function is deceptively simple but devastatingly effective: get onto a machine and then download additional malware, often ransomware. What makes Gootloader particularly insidious is its distribution method. Rather than relying on phishing emails, its operators used search engine poisoning — planting fake legal documents and business templates on compromised websites, especially hacked WordPress sites. Victims searching for contracts, agreements, or legal templates would find these booby-trapped pages near the top of their search results, download what appeared to be a legitimate document, and unknowingly install the loader.
According to the U.S. Department of Justice, Gootloader has infected at least 25,000 computers worldwide since 2018. Its operators monetized these infections by selling access to compromised systems to ransomware gangs and other criminal groups — a textbook cybercrime-as-a-service model.
In this latest action, police took down 14 servers and 218 domains associated with Gootloader and cleaned up 681 infected websites that had been serving malicious downloads. Dutch police also conducted further investigations targeting Gootloader’s main suspect.
CastleRAT and StealC: The Supporting Cast
Gootloader wasn’t the only target. The operation also dismantled infrastructure behind two other malware families that play complementary roles in the criminal ecosystem.
CastleRAT is a remote access trojan (RAT) that surfaced in 2025. Once installed on a victim’s machine, it gives attackers persistent remote control — the ability to execute commands, exfiltrate data, monitor activity, and deploy additional payloads. By taking down CastleRAT servers, investigators cut the lines that criminals used to maintain hands-on control of infected devices.
StealC is an infostealer designed to harvest credentials, cryptocurrency wallet data, and other sensitive information from compromised machines. Authorities dismantled 102 servers linked to StealC, building on an earlier June 2026 Endgame action that had targeted StealC alongside the SocGholish and Amadey malware families. That earlier operation had seized 326 servers and recovered 27 million stolen credentials. The continued pressure on StealC’s infrastructure demonstrates law enforcement’s strategy of sustained disruption rather than one-off takedowns.
6.4 Million Stolen Credentials Recovered
Perhaps the most immediately actionable outcome of this operation is the recovery of 6.4 million stolen credential datasets from the seized infrastructure. These credentials — usernames, passwords, authentication tokens — were being collected by the malware operators and sold to other criminals for use in account takeovers, network intrusions, and further ransomware attacks.
Europol confirmed that victim data from the CastleRAT takedown will be shared with breach notification services including Have I Been Pwned, the Dutch Institute for Vulnerability Disclosure (DIVD), and the Dutch police’s Check jeHack platform. This means that individuals and organizations whose credentials were harvested will have a way to discover whether they were affected and take steps to secure their accounts.
The Bigger Picture: Operation Endgame’s Growing Reach
This latest action is part of a sustained international campaign that has been accelerating throughout 2025 and 2026. Operation Endgame was first launched in May 2024 when Europol targeted initial access malware families including IcedID, SystemBC, Pikabot, Smokeloader, and Bumblebee. Since then, subsequent phases have dismantled the infrastructure behind Rhadamanthys, VenomRAT, Elysium, DanaBot, SocGholish, Amadey, and now Gootloader and CastleRAT.
The strategic logic is clear: rather than chasing individual ransomware gangs, law enforcement is systematically targeting the upstream supply chain — the loaders, stealers, and access brokers that provide ransomware operators with their initial foothold. As Europol put it, the operation is aimed at the cybercrime-as-a-service market where one group builds and maintains malware tools and others rent access to them.
However, as past operations have shown, disruption is not eradication. Some malware families targeted in earlier Endgame phases, such as DanaBot, have resurfaced after their infrastructure was rebuilt. The criminal market adapts, and the operators behind dismantled tools often migrate to new platforms or rebuild under different names.
What You Should Do Now
Europol’s advisory following this takedown emphasizes several practical steps:
WordPress site administrators should treat this as a wake-up call. Gootloader’s distribution relied heavily on compromised WordPress sites, and 681 of them were cleaned up in this operation alone. If you run a WordPress site, change your admin credentials immediately, enable multi-factor authentication, ensure all plugins and themes are patched to their latest versions, and audit your site for any unfamiliar files or redirects.
Organizations and individuals should check whether their credentials were among those recovered. Monitor Have I Been Pwned and similar services in the coming days and weeks as the recovered datasets are processed and added. If you discover your credentials were compromised, change passwords for the affected accounts and any other accounts where you reused the same password. Enable MFA wherever possible.
Security teams should review their environments for indicators of compromise associated with Gootloader, CastleRAT, and StealC. If your organization experienced unexplained credential theft, browser-based fake update prompts, or unrecognized remote access activity in recent months, treat it as a potential investigation signal. The fact that 6.4 million credential sets were sitting on criminal servers means a substantial number of organizations likely had footholds they didn’t know about.
What to Watch Next
Europol has indicated that the next phase of Operation Endgame will focus on acting on the intelligence recovered from the dismantled networks — identifying victims, tracing money flows, and pursuing the individuals behind these operations. Dutch authorities are already investigating Gootloader’s primary suspect.
The recovered 6.4 million credential sets also represent a goldmine of threat intelligence. Analyzing which organizations were targeted, which credentials were stolen, and how they were being packaged for sale can reveal patterns in how ransomware supply chains operate — information that defenders can use to anticipate and prevent future attacks.
Operation Endgame continues to demonstrate that coordinated, intelligence-driven infrastructure seizures can meaningfully degrade the capacity of cybercriminal markets. But as long as the demand for initial access persists, the cat-and-mouse game will continue. The question is whether law enforcement can sustain this tempo of disruption faster than criminals can rebuild.
Leave a Reply