Operation Endgame hits Gootloader, CastleRAT and StealC
Police seized 235 servers and 257 domains across three malware families and about 6.4 million stolen logins. No arrests were announced.
Morgan "airgap" ReyesConfirmed: an international police operation took down servers behind Gootloader, CastleRAT and StealC this week. No arrests were announced. The Hacker News reported the action on November 13, 2026.
What was seized
Across the three tools, police seized 235 servers and 257 domains, per an operation summary from Europol. Germany’s Federal Criminal Police Office (BKA) says about 6.4 million stolen logins belonging to more than 40,000 victims were also taken. The action is part of Operation Endgame.
Breakdown by tool, as reported:
- Gootloader: 14 servers and 218 domains taken down. Malware removed from 681 hacked websites.
- CastleRAT: 120 servers and 39 domains seized. A remote access trojan known since 2025.
- StealC: an infostealer. Servers taken down again after a June operation. Operators had rebuilt their infrastructure, German police said.
Gootloader
Gootloader is a loader. It downloads other malware, especially ransomware. It spread through fake legal documents on hacked websites, often WordPress sites, pushed up search results by SEO poisoning.
The U.S. Justice Department says it infected at least 25,000 computers worldwide since 2018. Operators sold access to ransomware criminals. In the U.S., it was used against at least 44 victims, with about $28.8 million in losses. German police give a far higher count: millions of computers since 2020. The two figures differ and the source does not reconcile them.
With court approval, U.S. agencies and partners removed Gootloader from more than 100 servers, including hacked WordPress sites, and seized U.S. domains used for delivery and control.
StealC infrastructure
Some StealC infrastructure ran on Virtualine/Omegatech, a bulletproof hosting service. Police shut that service down in a late-October takedown.
Victim checks
Dutch police loaded CastleRAT data into Check your hack. Enter an address; if it appears in the data, an email with removal steps arrives within minutes. No email means no match. More data is coming in the coming weeks. The service checks single addresses. Organizations can join No More Leaks. The data is also shared with Have I Been Pwned and the Shadowserver Foundation, which is working with ISPs and CSIRTs to notify owners of infected machines.
Police say emails claiming to be from them and linking to a data check are fake. Police do not send emails with links.
Residual risk, per police: criminals may still hold the stolen logins after seizure. While malware stays on a machine, passwords may keep leaking.
Related coverage: threat intelligence hub and ransomware.
Found this useful? Share it.
