Europol Operation Endgame disrupts Gootloader, CastleRAT, and StealC malware operations, recovers 6M+ stolen credentials
Europol, in collaboration with police forces from nine countries, dismantled the infrastructure supporting the Gootloader, CastleRAT, and StealC malware campaigns during the latest phase of Operation Endgame. The takedown included 235 servers and 257 domains, leading to the recovery of over 6 million stolen credentials harvested from infected devices. Gootloader infected victims mainly through fake legal documents planted on compromised websites, often WordPress sites, resulting in ransomware infections and extortion. CastleRAT, a stealthy remote access trojan active since 2025, enabled attackers to control victims' systems remotely, contributing to encrypted data and ransom payments. StealC, an infostealer also capable of deploying additional malware, harvested login credentials extensively and has been targeted by law enforcement since June 2026. Authorities recommend WordPress users update credentials, enable multi-factor authentication, and promptly patch vulnerabilities to mitigate risk. ### Technical Details The operation took down 14 servers and 218 domains linked to Gootloader, 120 servers and 39 domains linked to CastleRAT, and 102 servers belonging to StealC. Additionally, 681 infected websites were remediated. Stolen credentials associated with CastleRAT victims will be shared with notification services such as Have I Been Pwned to alert potential victims. The malware operators sold harvested credentials, which were then used in follow-on attacks including ransomware. ### Remediation Europol advises WordPress users to change their passwords, activate multi-factor authentication (MFA), and ensure all software is fully patched to prevent exploitation from compromised or vulnerable sites.
Linha do tempo
-
Europol Operation Endgame disrupts Gootloader, CastleRAT, and StealC malware operations, recovers 6M+ stolen credentials
ler a análise desta fonte ocultar
Europol, in collaboration with police forces from nine countries, dismantled the infrastructure supporting the Gootloader, CastleRAT, and StealC malware campaigns during the latest phase of Operation Endgame. The takedown included 235 servers and 257 domains, leading to the recovery of over 6 million stolen credentials harvested from infected devices. Gootloader infected victims mainly through fake legal documents planted on compromised websites, often WordPress sites, resulting in ransomware infections and extortion. CastleRAT, a stealthy remote access trojan active since 2025, enabled attackers to control victims' systems remotely, contributing to encrypted data and ransom payments. StealC, an infostealer also capable of deploying additional malware, harvested login credentials extensively and has been targeted by law enforcement since June 2026. Authorities recommend WordPress users update credentials, enable multi-factor authentication, and promptly patch vulnerabilities to mitigate risk. ### Technical Details The operation took down 14 servers and 218 domains linked to Gootloader, 120 servers and 39 domains linked to CastleRAT, and 102 servers belonging to StealC. Additionally, 681 infected websites were remediated. Stolen credentials associated with CastleRAT victims will be shared with notification services such as Have I Been Pwned to alert potential victims. The malware operators sold harvested credentials, which were then used in follow-on attacks including ransomware. ### Remediation Europol advises WordPress users to change their passwords, activate multi-factor authentication (MFA), and ensure all software is fully patched to prevent exploitation from compromised or vulnerable sites.