Operation Endgame Dismantles Malware Infrastructure, Recovers Millions of Stolen Credentials
An international law enforcement effort, Operation Endgame, has successfully disrupted Gootloader, CastleRAT, and StealC malware operations, seizing servers and recovering over six million stolen user credentials.
Law enforcement agencies across nine countries, in coordination with Europol, have successfully dismantled critical infrastructure behind three significant malware operations: Gootloader, CastleRAT, and StealC. This coordinated action, part of the ongoing international "Operation Endgame," has resulted in the seizure of 235 servers and 257 domains, effectively disrupting the supply chain for ransomware gangs and other cybercriminals.
The operation's success is underscored by the recovery of over six million stolen user credentials. These credentials, harvested from infected computers, were being sold on the dark web and utilized by threat actors for further malicious activities, including ransomware deployment and widespread fraud. Victim data associated with the CastleRAT operation will be provided to notification services like Have I Been Pwned, enabling individuals and organizations to check if their credentials were compromised.
Gootloader, a loader malware, was distributed through fake legal documents hosted on compromised websites, often targeting WordPress sites. Visitors downloading these malicious files would inadvertently infect their systems, paving the way for ransomware and extortion attacks. The takedown included 14 servers and 218 domains associated with Gootloader, alongside the cleanup of 681 infected websites.
CastleRAT, a sophisticated remote access trojan known since 2025, was designed for stealth and control. Europol links its activity to data encryption, IT system disruptions, and ransom demands. The operation seized 120 servers and 39 domains linked to this RAT, hindering its ability to compromise and control victim machines.
StealC, an infostealer capable of dropping additional malware, was targeted with the seizure of 102 servers. This operation continues previous efforts against StealC, which began in June 2026. The malware's primary function was to exfiltrate passwords, saved logins, and digital identities for sale on illicit markets.
Europol has issued advisories urging WordPress users to take immediate security measures. These include changing credentials, enabling multi-factor authentication, and ensuring all software is patched to prevent similar infections. The disruption of these malware operations represents a significant blow to cybercriminal enterprises relying on stolen credentials and compromised infrastructure.
Operation Endgame highlights the effectiveness of international collaboration in combating cybercrime. By targeting the underlying infrastructure and services that enable malicious activities, law enforcement aims to disrupt the entire cybercriminal ecosystem, from malware distribution to the final ransomware deployment.