Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins
Operation Endgame seized 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC, recovering 6.4M stolen logins from 40,000+ victims.
What’s new: A new phase of Operation Endgame has dismantled infrastructure behind the Gootloader loader, the CastleRAT remote access trojan and the StealC infostealer. Authorities seized 235 servers and 257 domains and recovered about 6.4 million stolen logins belonging to more than 40,000 victims. Germany’s BKA led the reporting with Europol support, joined by Dutch police, the U.S. Justice Department and Denmark’s National Special Crime Unit. Germany’s BSI is helping notify victims. No arrests were announced, though Dutch police are still investigating Gootloader’s main suspect.
What was taken down
- Gootloader: spread through fake legal documents planted on hacked, often WordPress, sites. Police took down 14 servers and 218 domains and cleaned malware from 681 compromised sites; U.S. agencies removed it from more than 100 servers. The DOJ says it has infected at least 25,000 computers since 2018 and was linked to ransomware attacks on at least 44 U.S. victims, with roughly $28.8 million in losses.
- CastleRAT: a remote access trojan seen since 2025. Police seized 120 servers and 39 domains.
- StealC: hit again after a June operation. Its operators had moved partly onto Virtualine/Omegatech bulletproof hosting, which was itself taken down in late October.
Who’s affected
Anyone whose credentials were harvested by these families, and owners of WordPress sites that were hijacked to host Gootloader lures. The stolen data is being shared with Have I Been Pwned and the Shadowserver Foundation for notification.
What to do
- Check whether your email address appears in the seized data using the Dutch police “Check your hack” service or Have I Been Pwned, and change any exposed passwords.
- Ignore emails claiming to be from police asking you to check your data; police do not send emails with links.
- WordPress site owners: set unique admin passwords of at least 12 characters, enable MFA, remove unknown accounts and backdoor code, keep WordPress, themes and plugins updated, and restrict /wp-admin to your own IP addresses.
