Operation Endgame hits Gootloader, CastleRAT and StealC: 235 servers and 257 domains taken down, 6.4 million victim credential sets found
- Victim notification: Europol says victim data will be made available through HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC.
- What these tools did: Gootloader served fake legal documents from hacked (often WordPress) sites as a ransomware entry point; CastleRAT is a hard-to-detect RAT Europol links to encrypted systems and ransom payments; StealC is an infostealer with a dropper function.
- Expect: takedowns disrupt rather than end these families; watch for rebuilt infrastructure.
Sources: Europol: 6.4 million victim datasets secured in international operation against malware networks (Nov 12, 2026) · Operation Endgame (Nov 12, 2026)