A coalition of law enforcement agencies from nine nations seized 235 computer servers and 257 internet domains powering the Gootloader, CastleRAT, and StealC malware networks. Coordinated by Europol and Eurojust, the action under Operation Endgame also recovered approximately 6.4 million compromised login credentials and datasets belonging to more than 40,000 victims.
"During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week," Europol stated.
The participating agencies included authorities from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States. For Gootloader, police seized 14 servers and 218 domains while cleaning malicious code from 681 compromised websites. CastleRAT infrastructure lost 120 servers and 39 domains, while 102 servers supporting the StealC credential stealer were dismantled. StealC previously relied on Virtualine/Omegatech, a criminal hosting provider closed by police in late October 2026.
Dismantling Loader Networks and Recovering Passwords
The targeted malware operations served as entry points for broader cyber attacks, including extortion and ransomware. In the United States, the Justice Department reported that Gootloader infected at least 25,000 systems since 2018, causing about $28.8 million in losses across at least 44 American victims. German investigators at the Federal Criminal Police Office, however, estimated that Gootloader compromised millions of machines worldwide since 2020.
With court authorization, United States authorities and international partners eradicated Gootloader from over 100 servers, including hijacked WordPress platforms, and seized domestic delivery domains. Denmark's National Special Crime Unit cleaned the 681 affected websites, reporting that attackers initially used stolen administrator credentials to install backdoor software. No arrests were announced during the operation, though Dutch police are conducting targeted inquiries into Gootloader's main suspect.
Recovered credentials are being shared with threat intelligence and notification services, including Have I Been Pwned, the Dutch police service Check your hack, No More Leaks, DIVD, NL-NCSC, Sekoia, and the Shadowserver Foundation.
