Operation Endgame hits Gootloader, CastleRAT and StealC: 235 servers and 257 domains seized, 6.4M victims' credentials identified
Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 13/11/2026 00:01; os links antigos trazem para cá.
Fontes: cyberscoop.com ↗ bleepingcomputer.com ↗ helpnetsecurity.com ↗
On 12 November 2026 Europol and police forces from nine countries announced a new phase of Operation Endgame that dismantled infrastructure behind three malware families: the Gootloader loader, the CastleRAT remote access trojan and the StealC infostealer. The action covered 235 servers and 257 domains (helpnetsecurity.com, bleepingcomputer.com, cyberscoop.com). Authorities identified credentials or datasets from about 6.4 million victims, which cybercriminals sold and used in follow-on attacks including ransomware (bleepingcomputer.com, cyberscoop.com). Affected-user data will be shared with notification platforms such as Have I Been Pwned (helpnetsecurity.com, cyberscoop.com). Cyberscoop.com describes Endgame as the largest international push against ransomware enablers to date, involving over 30 public and private partners.
Detalhes técnicos
- Gootloader (active since 2020, per bleepingcomputer.com): spread through fake legal documents planted on compromised, often WordPress, websites, leading to ransomware infections and extortion (helpnetsecurity.com, cyberscoop.com). 14 servers and 218 domains were taken down, and 681 infected websites were remediated (helpnetsecurity.com, cyberscoop.com).
- CastleRAT (active since 2025): a stealthy RAT giving attackers remote control of victim systems, linked to encrypted data and ransom payments (helpnetsecurity.com). 120 servers and 39 domains were seized (helpnetsecurity.com, cyberscoop.com). Credentials tied to CastleRAT victims will go to notification services such as Have I Been Pwned (helpnetsecurity.com).
- StealC: an infostealer with dropper capability that can deploy additional malware and targets credentials and cryptocurrency wallets (helpnetsecurity.com, bleepingcomputer.com, cyberscoop.com). 102 servers were seized, building on law-enforcement action since June 2026 (helpnetsecurity.com, cyberscoop.com).
- Operators sold the harvested credentials, which fed later attacks, including ransomware (helpnetsecurity.com, bleepingcomputer.com).
Remediação
- WordPress site owners and users should change passwords, enable multi-factor authentication (MFA) and promptly patch all software and vulnerabilities (all three sources).
- Stolen credentials will be shared with multiple platforms to alert and help remediate victims (bleepingcomputer.com, cyberscoop.com). Defenders should expect notifications and check their exposure.
Relatos divergentes
- Credential volume: helpnetsecurity.com (earliest report) says over 6 million stolen credentials were recovered. bleepingcomputer.com and cyberscoop.com, published later, cite 6.4 million victim datasets or victims. The figures are compatible, but the 6.4 million figure is more precise. The sources also differ on whether the unit is credentials or victims.
- Server totals: the per-family counts reported (14 Gootloader, 120 CastleRAT, 102 StealC) sum to 236, while all sources give a total of 235 servers. None of the sources explains the one-server difference. Domain counts (218 + 39) match the 257 total.
Linha do tempo
-
International Operation Endgame Dismantles Malware Networks, Exposes 6.4M Stolen Credentials
ler a análise desta fonte ocultar
An international law enforcement operation involving police forces from nine countries and Europol dismantled major infrastructure behind three malware kits: CastleRAT, Gootloader, and StealC. The takedown seized 235 servers and 257 domains, disrupting toolkits used for ransomware and data theft, and identified credentials belonging to 6.4 million victims. CastleRAT, a known remote access trojan, had 120 servers and 39 domains seized. Gootloader spread ransomware via fake legal documents on hacked WordPress sites, with 14 servers and 218 domains taken down, alongside cleanup of 681 infected websites. StealC—a stealer with dropper capabilities—had 102 servers seized, building on earlier action from June 2026. Victim credentials will be shared with major platforms like HaveIBeenPwned to notify affected users. Authorities advise WordPress users to update credentials, enable MFA, and patch vulnerabilities. This effort is part of Operation Endgame, the largest international push against ransomware enablers to date, involving over 30 public and private partners.
-
International law enforcement dismantles infrastructure of Gootloader, CastleRAT, and StealC malware operations
ler a análise desta fonte ocultar
Europol and partners from nine countries seized 257 domains and 235 servers linked to Gootloader, CastleRAT, and StealC malware families, disrupting their cybercriminal operations. Active since 2020, Gootloader is a loader, while CastleRAT (since 2025) is a remote access trojan, and StealC is an infostealer targeting credentials and cryptocurrency wallets. Authorities identified 6.4 million stolen victim datasets, utilized by cybercriminals for further attacks including ransomware. This action is part of Operation Endgame targeting cybercrime-as-a-service networks. Victims’ stolen credentials will be shared with multiple platforms to enable alerting and remediation, particularly urging WordPress users to update credentials and enable MFA.
-
Europol Operation Endgame disrupts Gootloader, CastleRAT, and StealC malware operations, recovers 6M+ stolen credentials
ler a análise desta fonte ocultar
Europol, in collaboration with police forces from nine countries, dismantled the infrastructure supporting the Gootloader, CastleRAT, and StealC malware campaigns during the latest phase of Operation Endgame. The takedown included 235 servers and 257 domains, leading to the recovery of over 6 million stolen credentials harvested from infected devices. Gootloader infected victims mainly through fake legal documents planted on compromised websites, often WordPress sites, resulting in ransomware infections and extortion. CastleRAT, a stealthy remote access trojan active since 2025, enabled attackers to control victims' systems remotely, contributing to encrypted data and ransom payments. StealC, an infostealer also capable of deploying additional malware, harvested login credentials extensively and has been targeted by law enforcement since June 2026. Authorities recommend WordPress users update credentials, enable multi-factor authentication, and promptly patch vulnerabilities to mitigate risk. ### Technical Details The operation took down 14 servers and 218 domains linked to Gootloader, 120 servers and 39 domains linked to CastleRAT, and 102 servers belonging to StealC. Additionally, 681 infected websites were remediated. Stolen credentials associated with CastleRAT victims will be shared with notification services such as Have I Been Pwned to alert potential victims. The malware operators sold harvested credentials, which were then used in follow-on attacks including ransomware. ### Remediation Europol advises WordPress users to change their passwords, activate multi-factor authentication (MFA), and ensure all software is fully patched to prevent exploitation from compromised or vulnerable sites.