Europol-Led Operation Seizes 235 Servers Running Gootloader, CastleRAT, and StealC Malware

Europol and law enforcement agencies from nine countries — Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States — announced on November 12 that they had seized 257 domains and 235 servers underpinning three malware operations: Gootloader, CastleRAT, and StealC. Europol and Eurojust coordinated the action, with private-sector partners helping identify, disable, and block the infrastructure, as part of Operation Endgame, the ongoing multi-year campaign against cybercrime-as-a-service networks.

Gootloader is a malware loader that has been active since 2020, typically distributed through compromised or malicious WordPress sites that trick visitors into downloading infected files disguised as legitimate documents. Once installed, it serves as an entry point for follow-on malware, including ransomware. StealC is an infostealer that harvests credentials, cryptocurrency wallet data, and other sensitive information from infected machines. CastleRAT is a more recently identified remote access trojan that gives attackers hands-on control of a compromised system. Investigators said the three operations shared enough underlying infrastructure to pursue them as a single, coordinated case.

Europol said the seized infrastructure held more than 6.4 million victim datasets, a scale that reflects how dependent WordPress site compromises have become as a distribution channel for commodity malware. Compromised sites have historically been difficult to clean up at scale because site administrators, not the malware operators, control patching and credential resets — which is why this takedown's victim-notification plan routes through established channels (including HaveIBeenPwned, the Dutch Institute for Vulnerability Disclosure, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation, and the Dutch national cyber security center) rather than a single centralized list. Site owners running WordPress are being urged to update their admin credentials, enable multi-factor authentication, and check for outstanding plugin and core vulnerabilities, since a seized malware network doesn't retroactively patch the compromised sites that fed it.

This is at least the third major Operation Endgame wave in 2026: a June action took down infrastructure tied to SocGholish and Evil Corp, and a separate June action disrupted Amadey and StealC infrastructure, seizing 326 servers and 142 domains and recovering roughly 27 million stolen credentials. The recurrence underscores a pattern Europol has flagged repeatedly — seizing servers disrupts an operation's reach temporarily, but the operators and the malware code generally survive to rebuild infrastructure elsewhere unless arrests accompany the takedown. No arrests were announced alongside this latest action.