Help Net Security reported on 12 November 2026 that police in nine countries and Europol shut down servers behind the Gootloader, CastleRAT and StealC malware this week. Europol called it the newest round of Operation Endgame. With private partners, officers took 235 servers and 257 domains. Gootloader lost 14 servers and 218 domains, CastleRAT 120 servers and 39 domains, and StealC 102 servers. More than 6 million logins lifted from infected computers were recovered.
Gootloader is a loader: it lands on a machine and fetches other malware, spread through fake legal files on hacked sites, often WordPress. CastleRAT is a remote access trojan, which lets an attacker control a computer from afar. StealC is an infostealer, which copies passwords and saved logins. Europol says the suspects sold stolen logins, and buyers used them in further attacks, including ransomware. Data from CastleRAT victims will go to services such as Have I Been Pwned, so those people and organisations may soon get an alert. It is not stated whether StealC or Gootloader data will be shared this way.
The sale of logins links a cheap infection to a ransomware attack. Seizing servers does not cancel logins already sold. Europol urges WordPress users to change credentials, turn on multi-factor authentication and patch. Leaders can ask three things: are password and session resets automated, does multi-factor cover admin and WordPress logins, and who watches for breach alerts?