- Europol and partners seized 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC. Police also identified millions of stolen credentials.
- Police say criminals may still hold stolen logins after a seizure, and infected computers may keep leaking passwords until the malware is removed.
- Check whether staff emails appear in the victim-notification services, and review whether your own website was used to spread Gootloader.
A takedown ends the servers, not the theft
When police seize a criminal's servers, the headline is easy to write. The harder question is what the criminals already took. This week's action shows the gap between the two.
Europol says it and its partners dismantled the infrastructure behind three malware tools: Gootloader, CastleRAT and StealC. Together with private companies, police acted against 235 servers and 257 domains. The work is part of Operation Endgame, which Europol says involves more than 30 public and private partners.
The lesson here is that a takedown protects future victims. It does little for people already infected. The open question for an organisation is whether any of its logins were in the haul.
What the police say they found
Europol says investigators found over 6 million victim credentials on the criminals' own systems. Germany's Federal Criminal Police Office (BKA) put the figure at about 6.4 million logins from more than 40,000 victims, according to The Hacker News.
Europol says the suspects sold these credentials to fund later attacks, such as ransomware.
Victims will be alerted through a list of services. Europol names Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and NL-NCSC. The alerts cover credentials stolen by CastleRAT.
Three tools, three jobs
Each tool does a different job. Together they form a supply line.
Gootloader is a loader. It gets onto a computer and then brings in other malware, especially ransomware. Europol says it spread fake legal documents through compromised websites, often hacked WordPress sites.
For Gootloader, Europol counts 14 servers and 218 domains taken down. It also says 681 infected websites were repaired.
CastleRAT is a remote access trojan, which lets an attacker control a computer from a distance. Europol says it has been known since 2025 and was built to be hard to detect. Police seized 120 servers and 39 domains.
StealC is an infostealer. It pulls saved passwords, access data and digital identities off infected machines so they can be sold or misused. Europol says 102 servers were dismantled, continuing work from June 2026.
Your website can be part of the attack
The Gootloader detail deserves a manager's attention. The lure was not on a criminal's own site. It sat on ordinary compromised websites.
According to The Hacker News, criminals used search engine poisoning to push those sites up the results. A person searching for a legal document then landed on a hacked page.
That makes the site owner an unwitting distributor. The Hacker News reports that, with court approval, U.S. agencies and partners cleared Gootloader from more than 100 servers. Some were hacked WordPress sites.
Europol urges WordPress users to update credentials, turn on multi-factor authentication and patch vulnerabilities.
Numbers that do not match
The sources disagree on scale. The Hacker News says the U.S. Justice Department counts at least 25,000 infected computers worldwide since 2018. German police say that, based on what investigators know so far, the total is millions since 2020.
The reports do not explain the gap. The two counts may measure different things. Treat the real figure as unknown, and do not assume your organisation is outside it.
Why the logins stay a risk
Police say in their frequently asked questions that criminals may still hold stolen logins after the data is seized. Passwords can also keep flowing to them while the malware sits on a computer. A password reset on a machine that is still infected can hand over the new password too.
StealC shows how this can go. The Hacker News reports German police saying its operators changed their infrastructure after the June action and came back online. That is one reported case, not a pattern. It does show that one takedown did not end this tool.
The Hacker News also reports that no arrests were announced this week. Dutch police are still investigating Gootloader's main suspect.
What to ask your team
First, ask whether staff and customer addresses appear in the victim services. Dutch police loaded CastleRAT data into Check your hack, which checks one address at a time. According to The Hacker News, organisations can join No More Leaks to receive data for a whole domain.
Second, ask whether an infected machine is clean before anyone resets a password. Reset first and the new password may be stolen. Remove the malware first.
Third, ask who checks your public website for planted files and unfamiliar pages. Gootloader relied on sites like yours.
Fourth, treat any email claiming to be from the police and asking you to check data as fake. According to The Hacker News, police do not send emails with links.
Seized servers make good news. A stolen password still opens a door until someone changes it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Europol.
