Europol takes down Gootloader, CastleRAT and StealC servers

Europol takes down Gootloader, CastleRAT and StealC servers

12 November 2026: Police coordinated by Europol have taken down 235 servers and 257 domains behind three malware services, Gootloader, CastleRAT and StealC, and recovered more than six million stolen credentials that are now being passed to breach-alert services. It is the latest phase of Operation Endgame, the long-running international action against the tools that feed ransomware and data theft.

Not yet independently verified. Europol's headline gives 6.4 million victim datasets while its text says more than six million credentials; we have not seen the full list of participating countries confirmed on one page. We will update this when it can be confirmed, and remove this note.

Three services, three different jobs

Each tool played a different part in the criminal supply chain, according to Europol.

• Gootloader, a loader spread through fake legal documents on compromised websites, many of them WordPress: 14 servers and 218 domains taken down, and 681 infected websites cleaned.
• CastleRAT, a remote access trojan known since 2025: 120 servers and 39 domains seized, with victim data shared so that people can be alerted.
• StealC, an information stealer that can also drop other malware: 102 servers dismantled, continuing work that began in June 2026.

Europol describes them as cybercrime-as-a-service, rented to other criminals who used them to break in, steal data and deploy ransomware.

Who gets told about stolen logins

The seized infrastructure held credentials for more than six million victims. Europol says the data is being made available through HaveIBeenPwned, the Dutch Institute for Vulnerability Disclosure, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and the Dutch national cyber security centre, which is issuing alerts for credentials stolen by CastleRAT.

For companies, the practical route is the monitoring they may already have: domain searches on HaveIBeenPwned and Shadowserver's free reports for network owners will show company accounts or addresses that turned up in the haul.

Advice for website owners

Because Gootloader lived on hijacked websites, Europol's advice is aimed at WordPress site owners in particular: change credentials, turn on multi-factor authentication and apply outstanding updates. A site that was one of the 681 cleaned may have been compromised through a plugin or a stolen administrator password, so the cleaning alone does not close the way in.

The partners behind it

Europol's European Cybercrime Centre provided intelligence, financial tracing and victim notification, and Eurojust supported the judicial side. The operation involved police from countries including Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, with more than 30 public and private partners in Operation Endgame as a whole. We list 15 password management products, the tools Europol's advice on changing credentials most directly calls for.

Related on TrustList:

• WordPress update race flaw CVE-2026-119977 is now being exploited

Sources

• Europol: 6.4 million victim datasets secured in international operation against malware networks, 12 November 2026
• Infobae: Desmantelan redes de malware que robaban contraseñas, 13 November 2026