Operation Endgame

6.4 million victim datasets secured in international operation against malware networks

Gootloader, CastleRAT, and StealC malware targeted in latest Operation ENDGAME cyber strike

Europol, alongside global partners, has dismantled the criminal infrastructure behind Gootloader, CastleRAT, and StealC malware. In coordinated actions, law enforcement seized 235 servers and 257 domains, severely crippling these malware distribution networks.

The operation targeted “cybercrime-as-a-service” models, where these tools enabled further crimes like ransomware attacks and data theft. During the action, 235 servers and 257 domains were actioned by law enforcement together with private parties.

The participating law enforcement and private partners took action against three malicious toolkits:

• Gootloader malware, a so-called dropper/loader, enabled unauthorised access to computer systems by distributing fake legal documents through compromised websites. Victims who downloaded these documents became infected, often via hacked WordPress sites. This widespread approach led to further criminal activities, including ransomware installation for digital extortion. 14 servers and 218 domains taken down; 681 infected websites remediated.
• CastleRAT is a remote access trojan (RAT) known since 2025. Such malware enables attackers to control an infected computer from a distance and to misuse it for criminal purposes. CastleRAT featured a modern technical architecture, could be deployed flexibly, and employed mechanisms that made its detection difficult. The use of CastleRAT resulted in the encryption of numerous data sets, the crippling of whole IT systems, and forced affected companies and organisations to pay ransom. 120 servers and 39 domains seized, with victim data shared for alerts.
• StealC malware (a so-called stealer with dropper function) was spread through multiple attack vectors. It was primarily designed to extract sensitive information such as passwords, stored access data and digital identities from compromised computers and to make them available for subsequent illicit use, especially data trading and fraudulent use. 102 servers were dismantled, continuing efforts from June 2026.

6.4 million victim credentials identified

During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week. The suspects were using these credentials, stolen from the victims after they infected them, to sell them and later be used for other cyberattacks such as ransomware.

Victim data will be made available via platforms HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC, alerting victims of stolen credentials caused by the CastleRAT malware. WordPress users are urged to update credentials, enable multi-factor authentication, and patch vulnerabilities.