Police in 9 countries have dismantled the servers and domains behind 3 malware operations that fed ransomware attacks and credential theft: the Gootloader loader, the CastleRAT remote access trojan and the StealC infostealer. Europol announced the action on Thursday, November 12, 2026, as the latest phase of Operation Endgame, and said investigators found about 6.4 million stolen credentials on the seized infrastructure.
According to Europol, law enforcement and private partners took action against 235 servers and 257 domains in total. Germany’s Federal Criminal Police Office (BKA) said in a joint statement with the Frankfurt prosecutor’s cybercrime unit (ZIT) that the coordinated actions ran from November 9 to 11.
What was taken down
Europol and national police released these figures for each malware family:
- Gootloader: 14 servers and 218 domains taken down, and 681 infected websites cleaned. Dutch police said all 14 servers were taken offline in the Netherlands.
- CastleRAT: 120 servers and 39 domains seized, including 6 servers in the Netherlands.
- StealC: 102 servers dismantled, 80 of them by Dutch police, following an earlier action against the malware in June 2026.
The BKA said more than 40 of the servers were located in Germany. The agencies taking part came from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States. The US contingent included the FBI Denver Division, the Defense Criminal Investigative Service, Army CID and the Justice Department’s Computer Crime and Intellectual Property Section. The UK’s National Crime Agency also took part, with Europol and Eurojust coordinating.
How the 3 tools were used
Gootloader has been active since 2020 and, according to the BKA, infected millions of systems worldwide, with Germany among the hardest-hit countries. Its operators hacked WordPress websites and used search engine poisoning to push them to the top of search results. Visitors looking for documents such as contracts or legal agreements were served fake files that installed the loader, which could then deliver more malware, including ransomware.
CastleRAT is a remote access trojan first seen in 2025. Europol said it was built to avoid detection and was used in attacks that encrypted data, crippled entire IT systems and pushed victim organizations into paying ransoms.
StealC is an infostealer that also works as a dropper. It pulls saved passwords, login data and digital identities from infected computers so they can be sold or used for fraud. The BKA said StealC’s operators rebuilt their infrastructure after the June action, and that much of the new setup ran on Virtualine, also known as Omegatech, a bulletproof hosting service that Frankfurt police and the Dutch National High Tech Crime Unit shut down at the end of October. BreachNews covered the FBI’s seizure of the Virtualine domain in late October.
No arrests announced
None of the agencies announced arrests in this phase. The Dutch police said investigative actions were carried out against the main suspect behind Gootloader, but did not name the person or say whether anyone was detained.
Since Operation Endgame began in 2024, the BKA says it has neutralized 17 malware families, led to 47 arrest warrants and seized or frozen more than €270 million in assets. In June 2026, Operation Endgame also disrupted the SocGholish malware network linked to Evil Corp, which also spread through hacked WordPress sites.
6.4 million credentials from more than 40,000 victims
Europol said the suspects were selling the stolen credentials for use in further attacks, including ransomware. The BKA put the haul at about 6.4 million credentials belonging to more than 40,000 victims, an average of roughly 160 stolen logins per victim.
Victim data will be shared with Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and the Dutch National Cyber Security Centre (NCSC). Dutch police said CastleRAT victim data can already be searched through the CheckjeHack page on politie.nl, with more records being added over the coming weeks. In Germany, the Federal Office for Information Security (BSI) is warning the internet providers of infected systems.
How to check if you were affected
- Search your email address on Have I Been Pwned and sign up for its free notifications, since the Endgame data may be loaded after this article is published.
- If you are told your device was infected, clean it or reinstall the operating system before you change any passwords, then change them from a clean device.
- Change every password saved in your browser, starting with email, banking and work accounts, and replace any password you reused elsewhere.
- Turn on multi-factor authentication and sign out of active sessions, since infostealers often grab session cookies as well as passwords.
Europol also urged WordPress site owners to change their admin credentials, enable multi-factor authentication and patch vulnerabilities, since hacked WordPress sites were Gootloader’s main delivery method. For more on how this type of malware works, read our guide on what infostealer malware is.
