Operation Endgame Recovers 6.4 Million Stolen Credentials After Seizing 235 Servers Behind Gootloader, CastleRAT and StealC

Police and prosecutors in nine countries, working with Europol, have dismantled infrastructure used by three malware operations: the Gootloader loader, the CastleRAT remote access trojan and the StealC information stealer, and identified 6.4 million stolen credentials on the servers they seized.

Europol announced the results on 12 November 2026 as the latest strike in Operation Endgame, which it describes as the largest international effort against the services that enable ransomware.

Germany's Federal Criminal Police Office (BKA) and the Central Office for Combating Internet Crime (ZIT) at the Frankfurt am Main Public Prosecutor General's Office said the action ran from 9 to 11 November.

Officers seized 235 servers and 257 domains, Europol said, and cleaned 681 infected websites.

The BKA said more than 40 of the servers were in Germany, and that the 6.4 million credentials related to more than 40,000 victims.

Private companies took part in the takedown; Europol did not name them in its release.

The three malware networks

The action targeted cybercrime-as-a-service tools used to break into computers, steal data and open the way to ransomware, Europol said.

• Gootloader, a dropper or loader, was spread through fake legal documents hosted on compromised websites, often hacked WordPress sites. People who downloaded the documents were infected, and the malware was then used to install further tools, including ransomware. Authorities took down 14 servers and 218 domains linked to Gootloader and cleaned 681 infected websites. The BKA said Gootloader first appeared in 2020, has infected millions of systems worldwide, and that Germany was among the countries most affected. It said the malware was widely spread through SEO poisoning, in which attackers manipulate search results so that malicious pages appear near the top.
• CastleRAT, a remote access trojan known since 2025, lets an attacker control an infected computer from a distance. Europol said it used techniques that made it hard to detect, and that it had been used to encrypt data, disable IT systems and press companies and other organisations to pay ransoms. Authorities seized 120 servers and 39 domains linked to CastleRAT and shared victim data for alerts.
• StealC, an information stealer that can also drop other malware, was used to take passwords, stored logins and digital identities from infected computers so they could be sold or used in fraud. Authorities dismantled 102 servers linked to StealC, continuing work that began in June 2026. The BKA said the operators had rebuilt infrastructure after that earlier action, including on the Virtualine/Omegatech bulletproof hosting service, which police in Frankfurt and the Dutch National High Tech Crime Unit took down in late October 2026.

6.4 million stolen credentials

Europol said more than 6 million victim credentials, given as 6.4 million in its headline figure, were identified in the criminal infrastructure seized this week.

The suspects had stolen the data from infected victims in order to sell it and to use it in further attacks, including ransomware.

Victim data will be made available through Have I Been Pwned, the Dutch Institute for Vulnerability Disclosure (DIVD), the Dutch police Check je hack service, NoMoreLeaks, Sekoia, the Shadowserver Foundation and the Dutch National Cyber Security Centre (NL-NCSC), Europol said, to alert people whose credentials were stolen by CastleRAT.

Germany's Federal Office for Information Security (BSI) is helping to notify victims in Germany, the BKA said.

People can check whether an email address appears in known breaches at https://haveibeenpwned.com and can use the Dutch police Check je hack service at https://www.politie.nl/informatie/checkjehack.html.

Europol also urged WordPress users to update their credentials, turn on multi-factor authentication and patch vulnerabilities.

Who took part

Europol listed participating agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States:

• Bulgaria: General Directorate for Combating Organised Crime, Bulgarian Police
• Canada: Royal Canadian Mounted Police
• Denmark: Danish Police (Politi)
• Germany: Federal Criminal Police Office (BKA)
• Moldova: Centre for Combating Cyber Crime of the National Inspectorate of Investigation, General Inspectorate of the Police
• Netherlands: Netherlands Police (Politie) and the Public Prosecution Office (Openbaar Ministerie)
• Poland: Central Cybercrime Bureau
• United Kingdom: National Crime Agency (NCA)
• United States: Defense Criminal Investigative Service (DCIS), the FBI's Denver Division, the Department of the Army Criminal Investigation Division (Army CID), and the Computer Crime and Intellectual Property Section (CCIPS) of the U.S. Department of Justice Criminal Division

Europol's European Cybercrime Centre (EC3) provided cyber intelligence, financial tracing and victim notifications.

Eurojust supported judicial authorities in exchanging information and synchronising the action.

Europol said Operation Endgame involves more than 30 public and private partners.

The announcements did not report any arrests, searches of premises or cryptocurrency seizures in this week's action.

Since the operation began in 2024 under German leadership, the BKA said, 17 malware variants have been disrupted, 47 arrest warrants have been issued and more than €270 million (about $299 million) in assets has been seized or frozen.

Dollar figures use the European Central Bank reference rate of €1 = $1.1081 on 12 November 2026.

Carsten Meywirth, head of the BKA's cybercrime department, said: "We fight cybercrime with stamina and, at the same time, a high tempo. Even technically skilled and well-organised cybercriminals must expect coordinated international investigations. We have shown once again that, together with our international partners and private cybersecurity companies, we can also take down malware that was thought to be untouchable. Anyone who rebuilds their infrastructure after police action leaves new traces, and we will follow them."

Dr Benjamin Krause, senior public prosecutor and spokesperson for ZIT, said the operation showed the value of working with private organisations as well as other law-enforcement agencies.

What users and organisations should do

• Check whether your email address appears in known breaches at Have I Been Pwned (https://haveibeenpwned.com) and, where relevant, at the Dutch police Check je hack service (https://www.politie.nl/informatie/checkjehack.html).
• If you are notified, or you suspect an infection, change the affected passwords from a computer that is known to be clean. Change those passwords on any other accounts where they were reused, and turn on multi-factor authentication.
• Sign out of other sessions and revoke app passwords or tokens for email, cloud, banking and administrative accounts, so a stolen cookie or session cannot keep an attacker signed in.
• If a notice says a device was infected, clean or rebuild it before signing in again. Do not enter new passwords on a machine that may still be compromised.
• Operators of WordPress sites should update WordPress, plugins and themes, rotate credentials, enable multi-factor authentication and look for unexpected files or downloads.
• Organisations that receive a notification from DIVD, Shadowserver, a national cyber security centre or a similar partner should treat it as a possible infostealer incident: reset affected accounts, revoke sessions, look for unauthorised access and be alert to follow-on ransomware.

Indicators of compromise

The announcements did not publish IP addresses or domain names.

The malware families targeted in this action were:

• Gootloader (dropper/loader)
• CastleRAT (remote access trojan)
• StealC (information stealer with a dropper function)