Europol says this week’s Operation Endgame action targeted Gootloader, CastleRAT and StealC, while stolen data found on the infrastructure will help alert affected users.
Authorities seized 257 domains and 235 servers used by the Gootloader, CastleRAT and StealC malware operations in an international action this week, Europol said. The action removes infrastructure used to spread malicious software and steal information.
The seizures are part of Operation Endgame. In November 2025, a separate action targeted Rhadamanthys, VenomRAT and Elysium infrastructure. In June 2026, authorities targeted SocGholish and Evil Corp infrastructure, followed later that month by Amadey and StealC infrastructure. Dutch police said they have monitored new versions of StealC since that takedown and carried out additional investigations targeting Gootloader’s main suspect.
Europol and Eurojust coordinated authorities from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK and the US. Private partners helped identify, take down, seize and block infrastructure, BleepingComputer said.
Gootloader is a malware loader, a program used to deliver malicious software. Dutch police said its operators infected WordPress websites and manipulated search results to draw visitors to sites that distributed malware. Infections led to ransomware attacks that locked victims’ files and systems.
CastleRAT is a remote-access trojan, a malicious program that can give an attacker control of a computer. StealC is an information stealer. Dutch police said such tools often form the first link in an attack chain, giving criminals access to data or networks for further crime. Dutch police said such tools can take login names, passwords, cryptocurrency wallets and system information, giving criminals information they can use to steal money or enter company networks.
Europol said authorities identified 6.4 million victim datasets on the targeted infrastructure. That figure counts datasets, not distinct people or organizations. Europol said suspects sold stolen credentials for use in further attacks, including ransomware.
The Android XR glasses go on preorder on 12 November. Google says sensors will block photo and video capture if the recording light is covered or tampered with.
Europol said victim data will be made available through HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC to alert people whose credentials were stolen by CastleRAT.
Dutch police said CastleRAT data can already be checked on their Check your hack page. Users enter an email address and receive an email within a few minutes if it matches a checked dataset; police advise checking the spam folder too. The service sends no email if the address is absent from those datasets.
Europol urged WordPress users to update their credentials, enable multifactor authentication and patch vulnerabilities. Dutch police expect to add more personal data to the checking service in the coming weeks.
2 min
Cloudflare placed warnings before the reported destinations after the security company’s researchers flagged them through its abuse system.
3 min
The model is available for noncommercial research and, DeepMind says, predicts DNA effects for a specified tissue, cell type or cell state.
2 min
