Law enforcement agencies coordinated by Europol announced on November 12, 2026 that they had dismantled a significant chunk of the infrastructure keeping three malware families alive: Gootloader, CastleRAT and StealC. The action, carried out under the long-running Operation Endgame banner, took down 235 servers and 257 domains and recovered roughly 6.4 million sets of victim data gathered from the seized systems.

Rather than chasing a single ransomware gang’s final payload, investigators went after the layer underneath it — the cybercrime-as-a-service businesses that sell access, loaders and stolen credentials to whoever is willing to pay. That model lets one compromised machine feed several different criminal operations at once, which is exactly why disrupting it has an outsized effect on the wider ecosystem.

Gootloader’s Fake Legal Documents Lose Their Launchpad

Gootloader has built its reputation on search poisoning: victims searching for contracts or business agreements land on compromised, often hacked WordPress sites serving malicious JavaScript disguised as a legitimate document. Once it runs, Gootloader acts as a delivery mechanism that can pull down further tools, making it a favorite entry point for groups that want a foothold before deploying ransomware.

Authorities say they took down 14 servers and 218 domains tied to Gootloader and cleaned up 681 compromised WordPress sites that had been unwittingly hosting the malicious lures. Site owners caught up in the cleanup are being told to reset credentials, turn on multi-factor authentication, patch outstanding vulnerabilities and remove any admin accounts they don’t recognize — all standard hygiene that becomes urgent once a site has been used as malware bait.

CastleRAT and StealC: Remote Access and Credential Harvesting at Scale

CastleRAT, a remote access trojan that has circulated since 2025 in both Python and C variants, gives attackers hands-on-keyboard control of an infected machine, including keylogging, screen capture and clipboard monitoring. That combination is valuable for reconnaissance before a bigger intrusion. Europol’s partners reported seizing 120 servers and 39 domains connected to the tool.

StealC, meanwhile, specializes in harvesting passwords, saved logins and other digital identity data that feeds directly into fraud and follow-on attacks. The operation dismantled 102 servers linked to StealC, building on a June 2026 Europol action that also hit StealC alongside the SocGholish and Amadey malware families — a sign that pressure on this particular service has been sustained rather than a one-off.

• Gootloader: 14 servers, 218 domains, 681 cleaned WordPress sites
• CastleRAT: 120 servers, 39 domains
• StealC: 102 servers
• Total victim datasets recovered: approximately 6.4 million

What Happens to the Recovered Victim Data

The millions of recovered records aren’t simply being filed away. Europol says the data will feed notification services including Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, Shadowserver and the Dutch National Cyber Security Centre, so affected individuals and organizations can find out whether their information was swept up in the campaigns. Europol’s European Cybercrime Centre handled the intelligence work, financial tracing and victim notification coordination, while Eurojust supported the judicial side across the participating countries.

Oddly, the published per-malware server figures add up to 236, one more than the stated overall total of 235, a discrepancy Europol hasn’t explained. The domain totals, by contrast, line up cleanly with the announced figure of 257. It’s a minor bookkeeping wrinkle, but one worth noting for anyone trying to cite exact numbers from the operation.

A Takedown Buys Time, Not Immunity

Infrastructure takedowns like this one disrupt the pipes criminals rely on, but they rarely end an operation outright. Server and domain seizures can be rebuilt, and the operators behind these services have shown they can resume activity under new infrastructure. For organizations and WordPress site owners that may have been touched by any of the three malware families, the practical takeaway is the same as always: rotate credentials, enable MFA, patch promptly and watch for the kind of anomalous account activity that these services are built to exploit. Operation Endgame has bought defenders some breathing room — what they do with it is up to them.