Takedown · Breaking

Police take down Gootloader, CastleRAT and StealC, the malware that opens doors for ransomware gangs

Europol says police in nine countries, working with private partners, seized 235 servers and 257 domains behind three malware kits that ransomware crews use to get in, and found 6.4 million sets of stolen victim credentials on them. Victim data is going to Have I Been Pwned, Shadowserver and others so people and companies can check.

Nov 12, 2026 · 3 min read

What happened. Europol announced on Nov 12 that police in nine countries (Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK and the US), working with private-sector partners, dismantled the infrastructure behind three malware kits: Gootloader, CastleRAT and StealC. In total, 235 servers and 257 domains were actioned. It is the latest round of Operation Endgame, which Europol calls the largest international effort against the services that give ransomware gangs their way in.

What was hit. Gootloader is a loader, meaning malware whose job is to get onto a machine and pull down more malware. It spread through fake legal documents planted on hacked WordPress sites that criminals pushed high in search results; Dutch police say an infection often ended in ransomware. Police took down 14 servers and 218 domains and cleaned 681 infected websites, and Dutch police say they also carried out actions against the main Gootloader suspect. CastleRAT, a remote access trojan known since 2025, lets an attacker control an infected computer from afar; Europol links it to encrypted data, crippled IT systems and ransoms paid. 120 servers and 39 domains were seized. StealC, an infostealer that can also drop other malware, lost 102 servers, continuing a takedown that started in June 2026.

The stolen logins. Investigators found more than 6 million sets of victim credentials (Europol says 6.4 million victim datasets) on the seized servers. The criminals were selling them for later attacks, including ransomware. Victim data is being shared with Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and the Dutch NCSC.

Why an enterprise should care. Infostealers and loaders are where many ransomware cases begin: one employee opens a "contract template" from a search result, and a saved VPN or SSO password ends up for sale. Takedowns like this slow those pipelines, but operators often rebuild, as StealC's return since June shows.

Do now. Check your company domains in Have I Been Pwned's domain search and watch for Shadowserver reports on your IP ranges. Force resets and review MFA for any staff whose credentials appear. Block or alert on JavaScript and ZIP downloads that pose as legal agreements or templates, and audit any WordPress sites you run for unknown admins and plugins.

Breach: Operation Endgame just took down Gootloader, CastleRAT and StealC, three malware kits ransomware crews use to get in. Europol: 235 servers and 257 domains seized, 6.4M stolen credential sets found. Check Have I Been Pwned for your domains.

Gootloader hides in fake legal documents on hacked WordPress sites that rank high in search. CastleRAT gives remote control and Europol ties it to ransomware hits. StealC lifts saved passwords for resale.
Why it matters: a stolen login from an infostealer is often the first step in a ransomware attack. If your staff's credentials are in this haul, reset them and check MFA before someone else uses them.

Police take down Gootloader, CastleRAT and StealC, the malware that opens doors for ransomware gangs

Sources