Operation Endgame has disrupted infrastructure supporting Gootloader, CastleRAT and StealC, three active malware services linked to credential theft, remote access and ransomware. Europol announced the results on 12 November 2026 after coordinated enforcement from 9 to 11 November.
Authorities reported affecting 235 servers and 257 domains across the three networks. They also secured approximately 6.4 million victim datasets or stolen credentials held on criminal systems.
Operation Endgame targeted malware supply chains
The action involved law enforcement partners in at least nine countries, coordinated by Europol and Eurojust. Germany’s Federal Criminal Police Office confirmed cooperation involving the Netherlands, Denmark, the United Kingdom, the United States and Canada during the three-day operational window.
Rather than focusing on a single ransomware group, Operation Endgame targeted services that help other criminals gain access, control devices and steal information. This cybercrime-as-a-service model allows attackers to purchase malware capabilities or use established infrastructure instead of developing their own tools.
Gootloader acts as an initial delivery mechanism, CastleRAT provides remote control, and StealC collects valuable information from infected systems. Disrupting their servers and domains can therefore interfere with several stages of an attack, from the first infection to credential theft and ransomware deployment.
The operation follows an earlier round on 24 June 2026 that targeted SocGholish, Amadey and StealC. StealC’s inclusion in both actions shows that law enforcement pressure against the service and its supporting infrastructure is continuing.
Gootloader servers, domains and websites disrupted
The Gootloader part of Operation Endgame covered 14 servers and 218 domains. Authorities also remediated 681 infected websites that had been used to support its delivery chain.
Gootloader commonly reaches victims through search poisoning. Attackers compromise legitimate websites, frequently sites built with WordPress, and create pages designed to rank for searches involving legal agreements, contracts and other document templates.
A user following one of these results may encounter a fake forum discussion or download page that appears relevant to the original search. The downloaded ZIP archive contains malicious JavaScript, which must be opened and executed by the user. Once running on a Windows device, the script stages the infection and can retrieve additional malicious tools.
This means the initial lure can look like an ordinary business task rather than an obvious security threat. Europol has linked Gootloader infections to subsequent ransomware deployment, making the loader significant even when its first-stage activity appears limited.
No particular WordPress release was identified as affected by the operation. The issue is compromised websites and accounts rather than a newly disclosed vulnerability in one specific version, so owners should not assume that a particular release alone defines their exposure.
CastleRAT remote access infrastructure seized
Authorities acted against 120 servers and 39 domains associated with CastleRAT. The remote access trojan has been known since 2025 and has appeared in both Python and compiled C variants targeting Windows environments.
CastleRAT gives an operator extensive control over an infected computer. Public analysis has documented functions including keylogging, screen capture and clipboard monitoring, all of which can expose passwords, confidential communications and information copied between applications.
The malware can also help an attacker maintain access while collecting data or preparing further activity. Europol described CastleRAT as flexible and difficult to detect, and linked its use to incidents involving data encryption, operational outages and ransom payments.
Open-source reporting has associated CastleRAT activity with a group tracked as TAG-150. However, the November action focused on dismantling technical infrastructure rather than announcing a new vulnerability, security patch or proof-of-concept exploit.
StealC servers and stolen credentials recovered
The StealC action dismantled 102 servers used by the information-stealing malware. StealC is offered as malware-as-a-service and is associated in public reporting with a developer using the name Plymouth.
StealC targets Windows systems and extracts information including browser passwords, cookies and saved login details. This data can enable account takeover, fraud or follow-on access to business services, particularly where stolen session cookies let an attacker bypass a normal login process.
Later StealC versions communicate using JSON over HTTP and employ RC4-based protection for strings or traffic. StealC v2, introduced in 2025, was described as a 64-bit rewrite. Europol also noted its ability to operate as a dropper, allowing it to introduce further payloads after the initial compromise.
There is a small discrepancy in the official figures. The published family-level counts are 14 Gootloader servers, 120 CastleRAT servers and 102 StealC servers, which total 236. Europol and the Dutch Police nevertheless state an overall total of 235 servers, and no explanation for the one-server difference was provided. The 257-domain total matches the Gootloader and CastleRAT breakdown.
Current exploitation and victim notification status
Gootloader, CastleRAT and StealC are operational criminal toolsets already used in the wild, not theoretical vulnerabilities awaiting exploitation. The takedown removed or seized infrastructure, but it does not automatically clean every infected endpoint, restore stolen information or invalidate credentials that criminals previously obtained.
As of 12 November 2026, authorities had not published an event-specific list of seized domains, IP addresses or malware hashes. Processing the 6.4 million recovered datasets will support notifications through several services and organisations, including:
- Have I Been Pwned
- DIVD and CheckjeHack
- NoMoreLeaks and Sekoia
- Shadowserver
- NL-NCSC and relevant national authorities
Germany’s BSI will assist with notifications to affected organisations in Germany. Network owners may also receive reports from Shadowserver or national incident response bodies as seized information is analysed.
Why Operation Endgame matters to UK organisations
The United Kingdom participated in this phase of Operation Endgame. UK organisations face relevant exposure because the disrupted services used familiar business activities, including WordPress publishing and web searches for document templates, to establish access.
The action may reduce the operators’ immediate capacity, but replacement infrastructure can appear and existing infections can remain active. Organisations should therefore treat a breach notification or related endpoint alert as evidence requiring investigation, not simply as confirmation that law enforcement has resolved the risk.
Actions following the malware disruption
WordPress administrators should follow Europol’s event-specific advice by changing administrative credentials, enabling multifactor authentication, applying available updates and removing unknown accounts. They should also review recently modified pages and unexpected content that could have supported search poisoning.
Organisations should check notifications from Have I Been Pwned, Shadowserver and relevant national services, then reset exposed credentials and revoke active sessions where necessary. Endpoint and network telemetry should be reviewed for suspicious JavaScript execution, unexpected payload downloads, credential access and communications associated with Gootloader, CastleRAT or StealC.
These steps address the main residual risk from Operation Endgame: systems or accounts that were compromised before the infrastructure was disrupted.
Originally reported by cybersecuritynews.com.
