Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Swati KhandelwalNov 13, 2026Malware / Cybercrime An international police operation took down servers behind Gootloader, CastleRAT and StealC this week. Criminals used the three malware tools to gain access to computers, steal passwords, and launch ransomware attacks. Police also seized about 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany's Federal Criminal Police Office (BKA). Gootloader is a loader: once on a computer, it could download other malware, especially ransomware. It spread through fake legal documents placed on hacked websites, often WordPress sites. Criminals used SEO poisoning to push those sites high in search results. Gootloader has infected at least 25,000 computers worldwide since 2018, the U.S. Justice Department said. Its operators used those computers to infect more computers, then sold access to the new ones to ransomware criminals. In the U.S., Gootloader was used in ransomware attacks against at least 44 victims, resulting in about $28.8 million in losses. German police gave a much higher count in their statement in German. Based on what investigators know so far, Gootloader has infected millions of computers worldwide since it first appeared in 2020. Across the three tools, police seized 235 servers and 257 domains, according to an operation summary from Europol, which supported the action. The takedown is part of Operation Endgame, an international police campaign against malware criminals use to access victims' computers. For Gootloader, police took down 14 servers and 218 domains and removed malware from 681 hacked websites. With court approval, U.S. agencies and their international partners removed Gootloader from more than 100 servers, including hacked WordPress sites. They also seized U.S. domains used to deliver and control the malware, according to the Justice Department announcement. CastleRAT, a remote access trojan (RAT) known since 2025, allows attackers to control an infected computer remotely. Police seized 120 of its servers and 39 domains. StealC is an infostealer that exfiltrates passwords and other login credentials from infected computers, allowing criminals to sell or misuse them. Police took down its servers again this week, after a June operation against it. After that June action, its operators changed their infrastructure and brought it back online to stay out of investigators' reach, German police said. Some of StealC's key infrastructure ran on Virtualine/Omegatech, a bulletproof hosting service that advertised its services to criminals. Police shut that hosting service down in a late-October takedown. No arrests were announced in this week's action. Dutch police also carried out further investigations targeting Gootloader's main suspect, according to their news release. Dutch police have loaded data stolen by CastleRAT into Check your hack, a police service where people can enter an email address. If the address is in the data, the police send an email within a few minutes with steps to remove the malware. If it is not, no email arrives. More data will be added in the coming weeks. The service checks single addresses, not whole domains, but organizations can join No More Leaks, a police project that shares data with private partners. The stolen data is also being shared with services including Have I Been Pwned and the Shadowserver Foundation. Emails that claim to come from the police and ask people to check the data are fake. The police never send emails with links. Even after police seize the data, criminals may still have the stolen logins, the police say in their frequently asked questions. As long as the malware stays on a computer, criminals may also keep getting its passwords. The Shadowserver Foundation is working with internet service providers and computer security incident response teams (CSIRTs) to find infected computers and notify their owners, the Justice Department said. In Germany, the Federal Office for Information Security (BSI) is helping notify victims, according to the BKA. Denmark's National Special Crime Unit (NSK) helped clean the 681 websites. In a statement in Danish, the unit said it believes the attackers got into the sites with stolen passwords that came through criminal channels. They then installed a backdoor. Officers removed the attackers' code and access, and left a message for the site owners with advice on securing their sites. Police in Denmark and the Netherlands advise WordPress site owners to take these steps, several of which are set out in a Dutch advice sheet: Change all administrator passwords to unique, at least 12-character passwords. Turn on multi-factor authentication (MFA). Update WordPress, its themes, and its plugins. Allow access to the /wp-admin login page only from the IP addresses of your own devices. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Credential Theft, Cybercrime, data theft, law enforcement, Malware, ransomware, Website Security Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot The Flood is Coming And The Pipes Were Already Full Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Secure My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk