Police in nine countries, working with Europol, took down servers behind the Gootloader, CastleRAT and StealC malware operations this week and recovered more than 6 million credentials stolen from infected computers. Europol announced the action as the latest round of Operation Endgame, the international campaign against the services that give ransomware gangs their way into a network.
Those logins are what reach ordinary users and companies. The suspects sold credentials they had harvested from victims’ machines, and buyers used them for further attacks, ransomware among them. Victim data tied to CastleRAT will go to notification services including Have I Been Pwned, so people and organizations whose passwords were taken may soon get an alert.
Europol and private-sector partners took 235 servers and 257 domains out of the criminals’ hands. Gootloader lost 14 servers and 218 domains. CastleRAT lost 120 servers and 39 domains. StealC lost 102 servers.
Gootloader is a loader, malware whose job is to get onto a machine and pull down other malware. Its operators planted fake legal documents on compromised websites, often hacked WordPress sites, and visitors who downloaded them were infected. Those infections led on to ransomware and extortion. Besides the servers and domains, 681 infected websites were cleaned up.
CastleRAT is a remote access trojan, a program that lets an attacker control an infected computer from a distance. It has been known since 2025, and Europol says it was built to be hard to detect. Europol links it to encrypted data, crippled IT systems, and companies and other organizations forced to pay ransoms.
StealC is an infostealer that can also drop other malware onto a machine. It pulled passwords, saved logins and digital identities off infected computers so they could be sold and used for fraud. This week’s action against its 102 servers continues work against StealC that began in June 2026.
Europol is urging WordPress users to change their credentials, turn on multi-factor authentication and patch vulnerabilities.
Click Here For The Original Source.
——————————————————–
