Police in nine countries seize 235 servers and 257 domains in Gootloader, CastleRAT and StealC crackdown

For most of the past decade, the quickest way into a corporate network has not been a bespoke hack but a rented one. Criminal groups lease ready made toolkits from specialist developers, point them at victims, and sell whatever they pull back out. Europol calls this division of labor cybercrime as a service, and it is the structure that a long running police campaign has been trying to break apart piece by piece.

Europol announced on November 12, 2026 that law enforcement from nine countries had dismantled the criminal infrastructure behind three of those rented tools: the Gootloader loader, the CastleRAT remote access trojan and the StealC infostealer. Police seized 235 servers and 257 domains, and identified roughly 6.4 million sets of victim credentials on the seized machines. The action is the latest phase of Operation Endgame, the international effort that Europol describes as the largest campaign ever mounted against the enablers of ransomware.

The three families played different roles in the same economy. Gootloader was a dropper, a piece of software whose only job is to get something worse onto a machine. Its operators poisoned search results with fake legal documents hosted on compromised websites, very often hacked WordPress installations, so that someone looking for a contract template or a court filing would land on a page that quietly delivered malware. CastleRAT, in use since 2025, is a remote access trojan built with a modern architecture and deliberate anti detection features, which gives an intruder a persistent foothold. StealC is a stealer with dropper functions, written to pull passwords, saved logins and digital identities off infected computers.

Operation Endgame has been running in phases, and this round continues work that began earlier in the year. Europol says the campaign brings together more than 30 public and private partners. The nine countries that took part this time were Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, working alongside Europol and Eurojust.

Key Facts

Europol's figures put the total seizure at 235 servers and 257 domains. The haul of credentials is the most striking number: about 6.4 million victim credential sets, which Germany's Federal Criminal Police Office, the BKA, says belonged to more than 40,000 victims. CyberScoop reported on November 12 that police in the nine countries seized the servers and domains and identified credentials belonging to 6.4 million victims, describing the sweep as one of the broadest strikes yet against the malware supply chain.

The three families were hit unevenly. CastleRAT accounted for the largest share of seized hardware, with 120 servers and 39 domains. Gootloader lost 14 servers and 218 domains, a lopsided result that reflects how much of its operation depended on a wide web of hijacked sites rather than on a small set of machines. StealC lost 102 servers, and Help Net Security reported on November 12 that this week's action built on work begun in June 2026.

Beyond servers and domains, 681 infected websites were cleaned up, according to Europol. The Hacker News reported on November 13 that Denmark's National Special Crime Unit, the NSK, carried out that cleanup after attackers had used stolen passwords to install backdoors on the sites. With court approval, U.S. agencies and partners also removed Gootloader from more than 100 servers, including hacked WordPress sites, and seized U.S. domains used to deliver and control the malware.

The U.S. Department of Justice supplied the damage estimate for Gootloader. According to the department, the loader infected at least 25,000 computers worldwide, was used in ransomware attacks on at least 44 victims in the United States, and caused roughly 28.8 million dollars in losses since 2018. German police go further on scale, saying Gootloader has infected millions of computers worldwide since it first appeared in 2020. Europol links CastleRAT to encrypted data sets, crippled IT systems and ransom payments.

No arrests were announced. Victim data will be distributed through a set of notification services and national authorities: HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and the Dutch national cyber security centre, NL-NCSC. Dutch police have loaded stolen CastleRAT data into a service called Check your hack, and they are investigating the main suspect behind Gootloader.

Analysis

The headline number is 6.4 million, but the more revealing detail is the ratio between servers and domains across the three families. CastleRAT, a single modern trojan, required 120 servers to run. Gootloader, an older and scrappier loader, needed only 14 servers but 218 domains. That is what a search poisoning operation looks like from the inside: cheap, disposable web real estate, constantly rotated, rather than one heavy central platform.

What this really means is that takedowns of this kind are becoming an exercise in inventory management as much as in investigation. Each phase removes a batch of servers and domains, and each phase is followed by rebuilding. StealC is the clearest example. Its servers were taken down in June 2026, its operators rebuilt part of the infrastructure on a bulletproof hosting provider called Virtualine or Omegatech, and that provider was itself shut down in late October, before this month's action took the rebuilt servers out again.

That cycle explains why Europol frames the campaign around enablers rather than around individual ransomware crews. The crews come and go. The loaders, trojans and stealers persist, because they are products with paying customers. Disrupting the product is slower and less dramatic than arresting a gang, but it raises the cost of every intrusion that depends on it, and it widens the pool of victims who can be told what happened to them.

There is also a data story here that deserves more attention than the seizure count. The credentials were not merely stored, they were inventory for sale. Europol says suspects sold harvested credentials for later attacks, ransomware among them. A working set of logins is the cheapest possible entry into a network, and with 6.4 million of them sitting on a handful of servers, the difference between a bad month and a very bad year for many organizations came down to whether those drives were reachable.

Why It Matters

The practical effect lands on ordinary IT teams. Europol's advice to WordPress users is blunt: change credentials, turn on multi factor authentication, and patch vulnerabilities. That advice is aimed at the population whose sites were used as bait. A compromised WordPress install does not only damage its owner. It becomes the shopfront for a fake legal document that pushes a loader onto a visitor's machine, and the visitor never learns where it came from.

CyberScoop reported on November 12 that U.S. Attorney Peter McNeilly for the District of Colorado said cybercrime knows no borders and praised the disruption of what he called this botnet. The comment captures the awkward geometry of these cases: a server in one country, a victim in another, a suspect in a third, and evidence that only becomes usable when several legal systems cooperate at once.

The notification pipeline matters for a second reason. When 6.4 million credential sets move from criminal infrastructure into the hands of HaveIBeenPwned, the Shadowserver Foundation and national agencies, people affected can finally reset passwords they did not know were exposed. That is the part of the operation with the longest tail, and it depends entirely on the seizures happening first.

Next Up

Attention now turns to the rebuilt infrastructure. StealC has already been taken down twice, and its operators have shown a willingness to relocate to whatever hosting will take them. Europol and its partners will be watching for the next provider that fills the gap left by Virtualine or Omegatech. The Dutch investigation into Gootloader's main suspect, and the absence of any announced arrests so far, are the two threads most likely to produce the next development.

For defenders, the immediate task is unglamorous. Patch the sites, rotate the passwords, enforce multi factor authentication, and check the notification services for an address that looks familiar. The servers are gone, but the credentials they held are the kind of asset that keeps its value until someone changes it.