Operation Endgame hits Gootloader, CastleRAT and StealC: 235 servers and 257 domains seized, 6.4M victims' credentials identified

Linha do tempo

1. securityaffairs.com ↗ · pub. 13/11/2026 11:35 · coletado 13/11 12:00

   International Law Enforcement Disrupts Gootloader Malware Infecting 25,000 Computers Globally

   ler a análise desta fonte ocultar

   The U.S. Department of Justice, in coordination with multiple international law enforcement agencies, has dismantled the Gootloader malware infrastructure by removing it from over 100 servers and seizing associated U.S. domain names. Gootloader has infected at least 25,000 computers worldwide since 2018, primarily via compromised WordPress and other websites that trick users into downloading malicious payloads. The malware operates on an access-as-a-service model, allowing ransomware groups such as SunCrypt and REvil to deploy secondary payloads, resulting in financial losses of approximately $28.8 million affecting at least 44 U.S. victims, including government sectors like the Department of War and the Defense Industrial Base. The disruption was achieved through a multinational effort including FBI, Europol, and others, supported by cybersecurity organizations and hosting providers, exemplifying effective global collaboration against malware botnets.

2. thehackernews.com ↗ · pub. 13/11/2026 07:55 · coletado 13/11 09:00

   International Police Operation Takes Down Gootloader, CastleRAT and StealC Infrastructure, Seizes 6.4M Stolen Credentials

   ler a análise desta fonte ocultar

   An international law enforcement operation known as Operation Endgame successfully dismantled critical infrastructure behind three major malware tools: Gootloader, CastleRAT, and StealC. These malware families were used to gain unauthorized access to computers, steal login credentials, and facilitate ransomware attacks, affecting millions globally. Authorities seized approximately 6.4 million stolen logins from over 40,000 victims and took down 235 servers and 257 domains linked to these malware operations. Gootloader distributed malware through SEO-poisoned hacked websites, primarily WordPress sites, and infected millions of computers worldwide since 2020, leading to significant financial losses, especially in the United States. CastleRAT enabled remote control of infected systems, while StealC acted as an infostealer exfiltrating passwords for criminal misuse. The takedown included the removal of malicious code from 681 hacked websites and disruption of a bulletproof hosting service used by criminals. While no arrests were announced yet, police have implemented services for victims to check for compromises and receive remediation guidance. Authorities emphasize sustained vigilance, patching, and strong security hygiene, particularly for WordPress site administrators, as these measures can mitigate future risks.

3. securityweek.com ↗ · pub. 13/11/2026 07:48 · coletado 13/11 08:00

   International Law Enforcement Seizes Infrastructure Used by Gootloader, CastleRAT, and StealC Malware

   ler a análise desta fonte ocultar

   Law enforcement agencies across the US, Europe, Australia, and Canada have dismantled the command and control infrastructure supporting the Gootloader, CastleRAT, and StealC malware operations. The joint operation led to the seizure of 235 servers and 257 domains, disrupting these cybercrime-as-a-service platforms known for facilitating ransomware, data theft, and other malicious activities. Gootloader, active since at least 2018, functions as a dropper distributed via compromised websites, infecting over 25,000 computers and causing approximately $28.8 million in US damages. CastleRAT, a remote access trojan in operation since 2025, provides attackers with control over infected systems to deploy ransomware, with law enforcement recovering 180,000 email addresses and 893,000 unique passwords linked to its victims. StealC, operating since at least 2023 as a stealer and dropper targeting passwords and identity data, had 102 servers disrupted, and over 6.4 million victim credentials seized, which were shared with security organizations to aid in mitigation efforts. The operation, part of “Operation Endgame,” has significantly weakened these malware campaigns and aims to prevent further criminal activities using stolen credentials.

4. haveibeenpwned.com ↗ · pub. 13/11/2026 02:41 · coletado 13/11 04:00

   Europol Dismantles CastleRAT Operation, Exposing 180k Emails and 893k Passwords from Infected Computers

   ler a análise desta fonte ocultar

   In November 2026, Europol and international law enforcement dismantled the infrastructure behind CastleRAT, a remote access trojan enabling criminals to control infected computers remotely. The investigation led to the exposure of approximately 180,000 email addresses linked to CastleRAT infections and 893,000 unique passwords, which appeared over 3 million times across compromised accounts. These passwords have been added to the Pwned Passwords database for public awareness and defensive use. Users are strongly advised to immediately change any affected passwords on all accounts and enable two-factor authentication where available to mitigate further risk. Usage of password managers to generate and securely store unique passwords is recommended to enhance account security.

5. gbhackers.com ↗ · pub. 13/11/2026 03:09 · coletado 13/11 04:00

   Europol Dismantles Infrastructure of Gootloader, CastleRAT, and StealC Malware Networks Seizing 235 Servers and 6.4 Million Stolen Records

   ler a análise desta fonte ocultar

   Europol, with international partners, disrupted the cybercrime-as-a-service infrastructure supporting Gootloader, CastleRAT, and StealC malware networks. The coordinated operation led to the seizure of 235 servers and 257 domains, and the recovery of 6.4 million victim datasets used for credential theft and enabling ransomware deployment. Gootloader exploited compromised WordPress sites to deliver malware through fake legal documents, CastleRAT provided flexible remote access trojan capabilities, and StealC functioned as an information stealer with dropper functionalities. Victims will be notified through services like HaveIBeenPwned and The Shadowserver Foundation. The operation targeted the enabling platforms rather than arresting all individual operators, highlighting ongoing efforts to disrupt infrastructure facilitating ransomware and data theft globally. WordPress administrators are advised to strengthen security measures including changing credentials and enabling multifactor authentication.

6. securityonline.info ↗ · pub. 12/11/2026 22:47 · coletado 12/11 23:00

   DOJ dismantles Gootloader malware botnet infecting 25,000+ systems globally

   ler a análise desta fonte ocultar

   The U.S. Department of Justice (DOJ), in coordination with international partners under Operation Endgame, has dismantled the Gootloader malware infrastructure by removing malicious code from over 100 compromised servers, including hijacked WordPress sites. This operation disrupted a global botnet responsible for infecting more than 25,000 systems since 2018 and linked to 44 ransomware attacks in the U.S. that resulted in approximately $28.8 million in losses. Authorities identified the infrastructure as operated by initial access brokers who sold access to ransomware affiliates. The takedown involved multinational law enforcement agencies and technical groups, significantly disrupting the malware’s operations. Organizations are advised to audit WordPress instances and update plugins to mitigate lingering infections.

7. cyberscoop.com ↗ · pub. 12/11/2026 13:55 · coletado 12/11 15:00

   International Operation Endgame Dismantles Malware Networks, Exposes 6.4M Stolen Credentials

   ler a análise desta fonte ocultar

   An international law enforcement operation involving police forces from nine countries and Europol dismantled major infrastructure behind three malware kits: CastleRAT, Gootloader, and StealC. The takedown seized 235 servers and 257 domains, disrupting toolkits used for ransomware and data theft, and identified credentials belonging to 6.4 million victims. CastleRAT, a known remote access trojan, had 120 servers and 39 domains seized. Gootloader spread ransomware via fake legal documents on hacked WordPress sites, with 14 servers and 218 domains taken down, alongside cleanup of 681 infected websites. StealC—a stealer with dropper capabilities—had 102 servers seized, building on earlier action from June 2026. Victim credentials will be shared with major platforms like HaveIBeenPwned to notify affected users. Authorities advise WordPress users to update credentials, enable MFA, and patch vulnerabilities. This effort is part of Operation Endgame, the largest international push against ransomware enablers to date, involving over 30 public and private partners.

8. bleepingcomputer.com ↗ · pub. 12/11/2026 12:07 · coletado 12/11 13:00

   International law enforcement dismantles infrastructure of Gootloader, CastleRAT, and StealC malware operations

   ler a análise desta fonte ocultar

   Europol and partners from nine countries seized 257 domains and 235 servers linked to Gootloader, CastleRAT, and StealC malware families, disrupting their cybercriminal operations. Active since 2020, Gootloader is a loader, while CastleRAT (since 2025) is a remote access trojan, and StealC is an infostealer targeting credentials and cryptocurrency wallets. Authorities identified 6.4 million stolen victim datasets, utilized by cybercriminals for further attacks including ransomware. This action is part of Operation Endgame targeting cybercrime-as-a-service networks. Victims’ stolen credentials will be shared with multiple platforms to enable alerting and remediation, particularly urging WordPress users to update credentials and enable MFA.

9. helpnetsecurity.com ↗ · pub. 12/11/2026 10:34 · coletado 12/11 11:02 primeiro registro

   Europol Operation Endgame disrupts Gootloader, CastleRAT, and StealC malware operations, recovers 6M+ stolen credentials

   ler a análise desta fonte ocultar

   Europol, in collaboration with police forces from nine countries, dismantled the infrastructure supporting the Gootloader, CastleRAT, and StealC malware campaigns during the latest phase of Operation Endgame. The takedown included 235 servers and 257 domains, leading to the recovery of over 6 million stolen credentials harvested from infected devices. Gootloader infected victims mainly through fake legal documents planted on compromised websites, often WordPress sites, resulting in ransomware infections and extortion. CastleRAT, a stealthy remote access trojan active since 2025, enabled attackers to control victims' systems remotely, contributing to encrypted data and ransom payments. StealC, an infostealer also capable of deploying additional malware, harvested login credentials extensively and has been targeted by law enforcement since June 2026. Authorities recommend WordPress users update credentials, enable multi-factor authentication, and promptly patch vulnerabilities to mitigate risk. ### Technical Details The operation took down 14 servers and 218 domains linked to Gootloader, 120 servers and 39 domains linked to CastleRAT, and 102 servers belonging to StealC. Additionally, 681 infected websites were remediated. Stolen credentials associated with CastleRAT victims will be shared with notification services such as Have I Been Pwned to alert potential victims. The malware operators sold harvested credentials, which were then used in follow-on attacks including ransomware. ### Remediation Europol advises WordPress users to change their passwords, activate multi-factor authentication (MFA), and ensure all software is fully patched to prevent exploitation from compromised or vulnerable sites.