An international law enforcement operation has shut down the infrastructure behind three major malware operations: Gootloader, CastleRAT and StealC, seizing 235 servers and 257 domains used by cybercriminals to distribute malicious software, steal sensitive information and support ransomware attacks.
Operation endgame disrupts three major malware networks
The coordinated action, conducted as part of Operation Endgame, also resulted in the identification and seizure of approximately 6.4 million stolen login credentials belonging to victims worldwide. According to Germany's Federal Criminal Police Office (BKA), the credentials were associated with more than 40,000 victims.
Gootloader spread malware through compromised websites
Gootloader is a malware loader that enables attackers to gain initial access to compromised computers and subsequently install additional malicious programs, including ransomware. Its operators distributed malware through fake legal documents hosted on compromised websites, frequently exploiting hacked WordPress sites.
The attackers also used search engine optimisation (SEO) poisoning to manipulate search results and direct unsuspecting users towards malicious downloads.
Since 2018, Gootloader has infected at least 25,000 computers worldwide, according to the U.S. Department of Justice. In the United States alone, the malware has been linked to ransomware attacks against at least 44 victims, resulting in estimated losses of approximately $28.8 million.
As part of the operation, authorities dismantled 14 servers and 218 domains associated with Gootloader and cleaned 681 compromised websites.
Castlerat and stealc enabled remote access and credential theft
The investigation also targeted CastleRAT, a remote access trojan that allows attackers to remotely control infected systems and use them for malicious activities. Authorities seized 120 servers and 39 domains linked to the operation.
Meanwhile, StealC, an information-stealing malware, was another major target. The malware is designed to extract sensitive information, including passwords, stored credentials and digital identities, from compromised computers.
This latest disruption follows an earlier law enforcement action against StealC in June 2026. Following that operation, its operators reportedly rebuilt their infrastructure and resumed activities to evade investigators.
Europol's European Cybercrime Centre (EC3) supported the investigation through cyber intelligence, financial tracking and victim identification. Authorities also plan to make information about affected users available through several cybersecurity platforms, including Have I Been Pwned, and the Shadowserver Foundation.
Although no arrests were announced during this latest action, Dutch authorities have continued investigations targeting Gootloader's suspected main operator.
Read the original article:
Operation Endgame Takes Down Three Malware Networks, Recovers 6.4 Million Stolen Logins