Operation Endgame: Police Take Down Gootloader, CastleRAT and StealC

WarBrief Live | November 14, 2026 | Cyber Warfare

Police in nine countries seized 235 servers and 257 domains in the latest Operation Endgame action, dismantling the Gootloader, CastleRAT and StealC malware networks and recovering 6.4 million stolen victim datasets. The coordinated action ran from November 9 to 11, 2026, and was announced by Europol on November 12. No arrests were announced, and the stolen logins police recovered still work — which is why the takedown matters as much for what victims do next as for what police seized.

What happened in Operation Endgame?

Operation Endgame is a multinational law-enforcement initiative that targets the infrastructure behind malware services — the tools criminals rent or buy to break into computers, steal logins and deliver ransomware. The latest phase, announced by Europol on November 12, 2026, was aimed at three distinct malware families: Gootloader, a loader that opens the door to further attacks; CastleRAT, a remote access trojan that lets attackers control infected computers; and StealC, an information stealer that harvests passwords and digital identities.

The action ran from November 9 to 11 and involved police and prosecutors from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, with Europol’s European Cybercrime Centre and Eurojust coordinating. More than 30 public and private partners supported the operation, including Proofpoint, Sekoia, Zscaler, abuse.ch, Spamhaus and Team Cymru. Europol said 235 servers and 257 domains were “actioned by law enforcement together with private parties”, and that more than 6 million victim credentials were identified in the criminal infrastructure seized during the week.

The scale is large, but the framing matters. Europol described the result as a severe disruption of the three networks, not their permanent elimination. No arrests were announced in any of the official releases, and none of the agencies has named the operators behind the three malware families. This is the pattern of Operation Endgame since it began: infrastructure goes down, operators rebuild, and police return. StealC itself was already targeted in June 2026 — and was back on the target list five months later.

What is Gootloader, and how did it infect 25,000 computers?

Gootloader is a malware loader that has been active since 2020. Its delivery method was deliberately mundane: fake legal documents hosted on compromised websites, frequently hacked WordPress installations. A visitor looking for a contract template or a legal form would download what appeared to be a document and instead receive the loader, which then opened the machine to further malware — including ransomware.

Investigators took down 14 Gootloader servers and 218 domains and remediated 681 infected websites. The US Justice Department ran its own Gootloader action alongside the international operation, removing the malware from more than 100 computer servers — including compromised WordPress sites — and seizing US domain names used to deliver and control it. The action was court-authorised, and the investigation was led by the Defense Criminal Investigative Service, the FBI’s Denver Field Office and the Army Criminal Investigation Division, working with agencies in Germany, the Netherlands, Canada, Denmark, France, the United Kingdom, Australia and Europol.

“With court authorization, the Department of Justice and FBI, along with our international partners, conducted an online operation that liberated over 100 servers from malicious software, denying ransomware criminals a platform.” — Assistant Attorney General A. Tysen Duva, US Department of Justice, November 12, 2026

The Justice Department’s figures show why Gootloader was a priority target. Since 2018, the malware has infected at least 25,000 computers worldwide. It has been used in ransomware attacks on at least 44 US victims, causing approximately $28.8 million in losses. Those are historical figures for the malware’s lifetime, not infections discovered in this week’s action — but they explain why a loader that arrives disguised as a legal document earned a nine-country response. For background on how these international raids are put together, see our explainer on how cybercrime takedowns work.

What is CastleRAT?

CastleRAT is a remote access trojan that surfaced in 2025. Once installed, it gives attackers remote control of the compromised computer — the ability to run commands, move files and maintain access while evading detection. Europol described flexible deployment, modern architecture and mechanisms intended to complicate detection, and linked CastleRAT-enabled intrusions to encrypted datasets, disrupted IT environments and ransom payments.

Authorities seized 120 CastleRAT servers and 39 domains and shared victim information so that affected people could be alerted. That notification work is already visible: on November 13, Have I Been Pwned loaded 179,700 email addresses and 893,000 unique passwords taken from computers infected with CastleRAT. It is the only victim data from the operation to have surfaced publicly so far, and it is a small fraction of the 6.4 million datasets — more may be added in the coming weeks, according to Dutch police.

Victim data from the operation is being made available through Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and NL-NCSC. Europol’s victim-alert language names CastleRAT specifically; the agency has not said whether Gootloader or StealC victim data will reach the notification services, or how much of the 6.4 million involves victims in any one country.

Why did police target StealC for a second time?

StealC is an information stealer with additional dropper functionality: it collects passwords, stored login credentials and digital identities from infected machines, and can also install other malware. The stolen data is sold on and used for fraud and further attacks, including ransomware. Authorities dismantled 102 StealC servers in this week’s action.

The notable point is that StealC was already a target five months ago. In June 2026, Operation Endgame disrupted infrastructure used by the Amadey and StealC malware operations, taking down 326 servers and 142 domains and recovering around 27 million credentials stolen from more than 385,000 compromised systems. The same June phase also cleaned nearly 15,000 malware-infected WordPress websites and seized 106 servers used by the SocGholish botnet and the Evil Corp cybercrime group.

That StealC needed hitting again in November says something important about this kind of enforcement. Takedowns remove infrastructure, not the business model: the code, the customer base and the criminal demand all survive, so operators rebuild on fresh servers. The November action is best read as a second round in the same fight, not a final one — and it is why Europol and its partners keep returning to the same families. Germany’s recent experience with supply-chain compromise shows the same pattern from the victim side: a fake software update grounded Germany’s drones at Quantum Systems just days before this announcement.

By the numbers: what police seized — and what the numbers do not say

The headline figures are striking, but they need careful reading. The table below separates what the agencies confirmed from what remains reported or unresolved.

Caveat: the per-family server counts (14 + 120 + 102) add to 236, one more than Europol’s stated total of 235, and Europol has not explained the difference. The 6.4 million figure counts datasets and credentials, not unique people — one victim’s machine typically holds many saved logins.

Two numbers deserve emphasis. First, the 6.4 million is datasets, not people: the BKA puts the victim count at more than 40,000, which means the average victim in this haul had roughly 160 credentials exposed. Second, Europol’s own arithmetic does not quite add up — 14 plus 120 plus 102 is 236, not 235. The domain figures, by contrast, match the stated total of 257. The discrepancy is small and changes nothing about the operation, but it is worth stating plainly rather than smoothing over, because the whole point of this kind of reporting is that the numbers can be checked.

What the Operation Endgame takedown means for US/UK/EU readers

For most readers, the direct impact is personal rather than geopolitical. If you have ever downloaded a document from an unfamiliar website, run a small business on WordPress, or reused a password across several services, you are in the population this operation was protecting. The 6.4 million datasets include everyday logins — email, banking, shopping, work accounts — harvested from infected machines and sold on for further attacks, including ransomware. The US Justice Department’s Gootloader figures put a price on that chain: at least 44 American victims and about $28.8 million in losses from ransomware attacks the loader enabled.

For WordPress site owners, the warning is specific. Gootloader spread through hacked WordPress installations, and Europol urged administrators to change credentials, enable multi-factor authentication and patch vulnerabilities. A compromised site does not only harm its owner — it becomes the delivery mechanism that infects the next visitor. For businesses, the disruption is welcome but temporary: ransomware gangs rent loaders like Gootloader precisely because the tooling is replaceable, and the June and November actions against StealC show how quickly a disrupted service returns. The broader ransomware threat that drives these takedowns is covered in our profile of Gunra ransomware and the FBI and CISA warning behind it.

For European readers, the operation was also a visible piece of cross-border policing: German, Dutch, Danish, Polish, Bulgarian, Moldovan and British agencies worked alongside the US and Canada under Europol and Eurojust coordination. That cooperation is the practical side of European security policy — the same machinery that handles sanctions enforcement and intelligence sharing, coordinated through the hubs on our tools page.

What should victims do now?

Seizing the servers does not change a single stolen password. Anyone who copied the credentials before the takedown can still use them, and the operators may hold copies of their own. The practical steps are straightforward, and they are the same ones Europol and the national police forces recommend.

• Check whether you are affected. Search your email addresses on Have I Been Pwned, which has already loaded the CastleRAT data from this operation and will add more if further datasets are released. Dutch readers can also use the police CheckjeHack service.
• Change exposed passwords — and do not reuse them. Treat any password found in a breach as compromised, even if the account still works. Use a unique password for every important service, ideally generated and stored by a password manager.
• Switch on multi-factor authentication on email, banking and work accounts. A stolen password alone is far less useful to an attacker when a second factor is required.
• WordPress administrators should change all credentials, enable multi-factor authentication, patch the core software, themes and plugins, and scan for injected code — 681 infected sites were cleaned in this operation alone.
• Do not download documents from unfamiliar sites, however official they look. Gootloader’s entire business model depended on people trusting a fake legal form.

What to watch next in Operation Endgame

Several questions remain open. First, whether Europol clarifies the 236-versus-235 server discrepancy — a small point, but one that tests how carefully the agencies’ own numbers are checked. Second, whether the Gootloader and StealC victim data reaches the notification services, or whether only the CastleRAT data is released; at present, only CastleRAT victims can check Have I Been Pwned. Third, whether any arrests follow: Operation Endgame has historically been an infrastructure operation, and the absence of arrests in the November announcements fits that pattern, but follow-on prosecutions would change the assessment.

Fourth, watch how fast the three families reappear. StealC was hit in June and again in November; Gootloader has been active since 2020 and survived years of enforcement attention before this action. The next phase of Operation Endgame — and whether it targets the same families a third time or moves to new ones — will show whether this campaign is shrinking the malware-for-hire market or simply forcing it to change servers. Either way, the lesson for readers is the same: the infrastructure can be seized in a week, but the stolen data outlives it.

Frequently asked questions

What is Operation Endgame?
Operation Endgame is a multinational law-enforcement initiative, coordinated by Europol and Eurojust, that targets the infrastructure behind malware services used by ransomware gangs and other criminals. It has run several phases since 2024, taking down botnets and malware loaders including Smokeloader, IcedID, Trickbot, DanaBot, SocGholish, Amadey and now Gootloader, CastleRAT and StealC.

Was anyone arrested in the November 2026 Operation Endgame action?
No arrests were announced in the Europol, US Justice Department, German BKA or Dutch police releases covering the November 9–11 action. The operation seized servers and domains and recovered victim data; it did not name or charge any operators.

Are my passwords safe now that the servers have been seized?
No. Seizing the servers does not change the passwords, and anyone who copied the stolen credentials before the takedown can still use them. Check Have I Been Pwned, change any exposed passwords, use unique passwords for important accounts and switch on multi-factor authentication.

How do I check if my data was in the Operation Endgame haul?
Search your email addresses on Have I Been Pwned, which loaded 179,700 CastleRAT email addresses and 893,000 unique passwords on November 13, 2026. Dutch residents can also use the police CheckjeHack service. Further datasets from Gootloader and StealC may be added in the coming weeks.

What is the difference between Gootloader, CastleRAT and StealC?
Gootloader is a loader: it tricks victims into downloading it, usually disguised as a legal document, and then opens the machine to other malware. CastleRAT is a remote access trojan: it lets attackers remotely control an infected computer. StealC is an information stealer: it harvests passwords, stored credentials and digital identities for resale and further attacks.

Sources

• Europol: 6.4 million victim datasets secured in international operation against malware networks
• US Department of Justice: Gootloader Malware Disrupted in International Cyber Operation
• BleepingComputer: Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
• GBHackers: Europol Dismantles Three Major Malware Networks, Seizes 235 Servers and 6.4 Million Stolen Records
• Security Point Break: Operation Endgame: 180K CastleRAT Victims Now on HIBP