Europol Dismantles Global Malware Infrastructure in Operation Endgame
Europol and international partners have disrupted the infrastructure of Gootloader, CastleRAT, and StealC malware, seizing 235 servers and 257 domains.
Europol, in collaboration with international law enforcement agencies, has announced a significant blow against cybercrime operations with the disruption of infrastructure supporting three key malware families: Gootloader, CastleRAT, and StealC. The operation, dubbed 'Operation Endgame,' successfully took down 235 servers and 257 domains that were instrumental in facilitating ransomware attacks and widespread data theft. This coordinated action targeted the cybercrime-as-a-service (CaaS) model, a prevalent business strategy where criminals lease or sell access and tools to other malicious actors.
Gootloader, a notorious loader malware, was a primary focus. It typically lures victims through sophisticated social engineering tactics, often using fake legal documents hosted on compromised websites, including popular WordPress sites. The operation dismantled 14 Gootloader servers and 218 associated domains, while also cleaning 681 infected websites. Gootloader's ability to deliver secondary payloads makes it a critical initial access vector for more destructive attacks, including ransomware.
CastleRAT, a remote access trojan known since 2025, provided attackers with extensive control over infected systems. Authorities seized 120 servers and 39 domains linked to this malware. CastleRAT, often developed in Python and C, offers capabilities such as keylogging, screen capture, and clipboard monitoring, enabling persistent access and information gathering for threat actors.
StealC, which specializes in harvesting credentials, saved login details, and digital identities, was also targeted, with 102 servers linked to its operations being dismantled. The data stolen by StealC fuels further fraudulent activities and facilitates deeper network intrusions. This takedown follows a similar Europol operation in June 2026 that also targeted StealC, indicating ongoing pressure on this persistent threat.
Beyond the server and domain takedowns, authorities recovered an estimated 6.4 million victim datasets from the compromised criminal infrastructure. These recovered datasets are expected to be used to issue alerts through various cybersecurity services, including Have I Been Pwned, Sekoia, and Shadowserver, enabling affected individuals and organizations to take protective measures.
The success of Operation Endgame highlights the importance of international cooperation in combating sophisticated cybercrime networks. By targeting the underlying infrastructure and CaaS models, law enforcement aims to disrupt the entire attack chain, from initial access to final payload deployment, rather than focusing solely on individual ransomware incidents.
While the operation represents a significant disruption, Europol emphasizes that affected users and organizations must still take proactive steps to secure their systems. This includes changing credentials, enabling multi-factor authentication, patching vulnerabilities, and removing unauthorized accounts. The ongoing threat from these malware families necessitates continued vigilance and robust security practices from all internet users.
This latest report from CyberScoop provides further details on Operation Endgame, highlighting the specific malware kits targeted: CastleRAT, Gootloader, and StealC. It elaborates on the seizure of 235 servers and 257 domains, and importantly, identifies over 6.4 million stolen credentials that were recovered. The article also emphasizes the advice given to WordPress users to secure their accounts, a crucial mitigation step following the operation's success.