---
title: Operation Endgame hits Gootloader, CastleRAT and StealC: 235 servers and 257 domains taken down, 6.4 million victim credential sets found | ctxsec
url: https://ctxsec.com/items/europol-operation-endgame-gootloader-castlerat-stealc-235-servers-257-domains-6-4m-credentials
description: "Europol says law enforcement and private partners took action against 235 servers and 257 domains behind three crime-as-a-service toolkits: Gootloader (14 servers and 218 domains taken down, 681 infected websites remediated), CastleRAT (120 servers and 39 domains seized) and StealC (102 servers dismantled, continuing June 2026 action). Over 6 million victim credential sets were found on the seized infrastructure. Agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK and the US took part, coordinated by Europol and Eurojust."
status: "official (Europol and Operation Endgame, Nov 12, 2026)"
published: 2026-11-12
---

> Europol says law enforcement and private partners took action against 235 servers and 257 domains behind three crime-as-a-service toolkits: Gootloader (14 servers and 218 domains taken down, 681 infected websites remediated), CastleRAT (120 servers and 39 domains seized) and StealC (102 servers dismantled, continuing June 2026 action). Over 6 million victim credential sets were found on the seized infrastructure. Agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK and the US took part, coordinated by Europol and Eurojust.

[← Cybersecurity News](/news) · [markdown](/items/europol-operation-endgame-gootloader-castlerat-stealc-235-servers-257-domains-6-4m-credentials.md)

official (Europol and Operation Endgame, Nov 12, 2026)

2026-11-12 3:39 PM ET

### Operation Endgame hits Gootloader, CastleRAT and StealC: 235 servers and 257 domains taken down, 6.4 million victim credential sets found

- **Victim notification:** Europol says victim data will be made available through HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC.
- **What these tools did:** Gootloader served fake legal documents from hacked (often WordPress) sites as a ransomware entry point; CastleRAT is a hard-to-detect RAT Europol links to encrypted systems and ransom payments; StealC is an infostealer with a dropper function.
- **Expect:** takedowns disrupt rather than end these families; watch for rebuilt infrastructure.

Sources: [Europol: 6.4 million victim datasets secured in international operation against malware networks (Nov 12, 2026)](https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks) · [Operation Endgame (Nov 12, 2026)](https://www.operation-endgame.com/)