Operation Endgame Hits Gootloader, CastleRAT and StealC: 235 Servers Down, 6.4 Million Logins Still in Play

TL;DR

• what: Operation Endgame, supported by Europol, took down 235 servers and 257 domains used by the Gootloader loader, the CastleRAT remote access trojan and the StealC infostealer, and seized about 6.4 million stolen logins.
• impact: Gootloader alone is tied to at least 25,000 infected computers and about $28.8 million in losses across at least 44 US ransomware victims, and German police say the true infection count runs into the millions.
• fix: Police are notifying victims through Check your hack, No More Leaks, Have I Been Pwned and the Shadowserver Foundation, and have cleaned 681 hijacked websites, but they warn that criminals may still hold the stolen logins and that malware left on a computer keeps stealing passwords.
• who: Organizations whose staff download documents found through search engines, owners of WordPress sites, and any company whose employee credentials passed through CastleRAT or StealC infections.

The way in was always mundane. Someone searched for a legal document, clicked a high-ranking result, and downloaded what looked like the file they needed. The site was a hacked WordPress page, pushed up the rankings through SEO poisoning, and the document was Gootloader. From there, the infected machine became a product: its operators used it to infect more computers, then sold that access to ransomware crews.

This week, that business took a hit. An international police operation under the Operation Endgame banner took down servers behind Gootloader, the CastleRAT remote access trojan and the StealC infostealer. According to Germany's Federal Criminal Police Office (BKA), police also seized about 6.4 million stolen logins belonging to more than 40,000 victims. Europol, which supported the action, counts 235 servers and 257 domains seized across the three tools.

What was taken down

The three tools cover the full early stage of a modern intrusion: getting in, keeping control, and harvesting credentials to sell or reuse.

• Gootloader: 14 servers and 218 domains taken down, malware removed from 681 hacked websites. With court approval, US agencies and international partners removed Gootloader from more than 100 servers, including hacked WordPress sites, and seized US domains used to deliver and control it.
• CastleRAT: a remote access trojan known since 2025. Police seized 120 of its servers and 39 domains.
• StealC: an infostealer that exfiltrates passwords and login credentials. Its servers were taken down again, after a June operation against it.

The US Justice Department says Gootloader has infected at least 25,000 computers worldwide since 2018, and was used in ransomware attacks against at least 44 US victims, resulting in about $28.8 million in losses. German police put the number far higher: based on what investigators know so far, they say Gootloader has infected millions of computers since it first appeared in 2020.

Two agencies, two very different numbers — The Justice Department cites at least 25,000 infections since 2018. The BKA says millions since 2020. The gap likely reflects what each agency can prove in its own jurisdiction versus what investigators observed overall. For risk planning, the 44 confirmed US ransomware victims and $28.8 million in losses are the floor, not the ceiling.

StealC already came back once

The most telling detail in this operation is about StealC. Police hit it in June. Its operators then changed their infrastructure and brought it back online to stay out of investigators' reach, German police said. Some of that rebuilt infrastructure ran on Virtualine/Omegatech, a bulletproof hosting service that advertised to criminals. Police shut that host down in a late-October takedown, and this week took StealC down again.

No arrests were announced. Dutch police say they carried out further investigations targeting Gootloader's main suspect, but the operators of all three tools remain, as far as the public record shows, free to rebuild.

The victims nobody sees: 681 hijacked websites

Gootloader needed legitimate websites to work, and it got them with stolen passwords. Denmark's National Special Crime Unit (NSK), which helped clean the 681 sites, said it believes attackers got in using passwords that came through criminal channels, then installed a backdoor. Officers removed the attackers' code and access and left a message for site owners with advice on securing their sites.

Police in Denmark and the Netherlands advise WordPress site owners to use unique administrator passwords of at least 12 characters, turn on MFA, remove unrecognized accounts and backdoor code, keep WordPress, themes and plugins updated, and restrict the /wp-admin login page to their own IP addresses. The loop is the point: stolen credentials opened the websites, and the websites delivered malware that stole more credentials.

What happens to 6.4 million logins

Dutch police have loaded data stolen by CastleRAT into Check your hack, a police service that emails steps to remove the malware if a submitted address appears in the data. More data will be added in the coming weeks. The service checks single addresses, not whole domains, but organizations can join No More Leaks, a police project that shares data with private partners. The data is also going to Have I Been Pwned and the Shadowserver Foundation, which is working with ISPs and CSIRTs to notify owners of infected computers. In Germany, the BSI is helping notify victims.

⚠️ Takedown-themed phishing is fake — Police say emails claiming to come from them and asking people to check the data are fake. The police never send emails with links. They also warn that criminals may still have the stolen logins even after seizure, and that malware left on a computer can keep stealing passwords.

The RedEye take

Operation Endgame is doing real damage, and this action deserves credit: removing malware from 681 websites and pushing seized credentials into notification channels is victim-focused work, not just a press release about seized servers. But defenders should read the StealC history as the headline. A takedown without arrests degrades infrastructure; it does not retire the people running it. StealC moved hosts after June and was back. The likely outcome here is a quieter period followed by rebuilt services under the same or new names.

The more lasting harm is already done. Six million logins do not become safe because police hold a copy. Any credential that passed through these tools should be treated as permanently known to criminals, and any organization waiting for a police email to find out it was affected has already handed the timeline to the attacker.

What defenders should learn

• A takedown is a notification event, not a resolution. Police say criminals may still hold the logins and active infections keep harvesting. Treat any match in this data as a live incident: endpoint cleanup and credential rotation together, since rotating passwords on a still-infected machine hands over the new ones.
• Single-address checks do not scale to an enterprise. Check your hack works one email at a time. Domain-level visibility comes from programs like No More Leaks and feeds from Have I Been Pwned and Shadowserver, and those relationships are worth having in place before the next seizure.
• Your public website is someone else's attack infrastructure. The 681 sites were opened with stolen passwords. Marketing-owned WordPress admin accounts often sit outside corporate identity controls; bring them into the same MFA and access review program as everything else.
• Search results are an initial access vector. Gootloader relied on staff searching for legal documents, not on email. Awareness programs focused on inbox phishing miss the legal, finance and HR employees most likely to download templates from the open web.
• Prepare the helpdesk for takedown-themed lures. Fake police emails about this data are already a stated risk. Tell staff in advance that police never send links, so the warning lands before the lure does.

Source: The Hacker News, "Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins," November 13, 2026, citing the BKA, Europol, the US Justice Department, Dutch police and Denmark's NSK. https://thehackernews.com/2026/11/operation-endgame-takes-down-gootloader.html

Originally published on RedEye Threat Intelligence.