Operation Endgame takes down Gootloader, CastleRAT and StealC servers

An international police operation took down servers behind Gootloader, CastleRAT and StealC this week, according to a report published on 13 November 2026. The three tools were used by criminals to get into computers, steal passwords and run ransomware attacks.

Police also seized about 6.4 million stolen logins belonging to more than 40,000 victims, Germany's Federal Criminal Police Office (BKA) said.

What happened

The takedown is the headline. The seizure of the credential stash is the part that will matter to defenders for longer.

Gootloader is described as a loader, the first stage that gets code onto a machine and then pulls something else down. CastleRAT and StealC sit further along the same chain: a remote access tool and an infostealer. That's the shape of a typical intrusion pipeline, and it explains why the three were grouped in one operation rather than treated as separate cases.

The report doesn't say which countries took part, which servers were seized or where they were hosted. It doesn't say whether anyone was arrested or charged. It doesn't say whether the infrastructure is fully gone or partly rebuilt.

Technical mechanism and impact

A loader's job is to be unremarkable. It arrives, it runs, it fetches. Gootloader has a long history of arriving through poisoned search results, though this report doesn't describe the delivery method used here, so we won't assume one.

CastleRAT gives an operator a foothold they can drive. StealC takes credentials and session data off the machine. Put together, that's access, control and a way to monetise both, and the report states plainly that the tools fed ransomware attacks.

The 6.4 million logins are the concrete number here. They were already stolen before the servers came down, which means the seizure is a disruption of the market, not a reversal of the theft. Credentials sitting in a police evidence locker are still credentials that were exposed on someone's machine.

HackZoneLabs assessment

In our view, the credential count is the part worth acting on, and it's the part the announcement gives least detail about. The BKA figure covers more than 40,000 victims, but nobody has said which services those logins belong to, whether the passwords are current, or whether the affected people have been told. Without that, an organisation can't check whether it's in the set.

We'd treat the takedown as a real but partial win. Removing a loader's servers raises the cost of the next campaign and disrupts whatever was already staged. It doesn't clean machines that are already infected, and it doesn't rotate a single password. Anyone who had CastleRAT or StealC on a host still has a compromised host until someone looks.

The grouping of three tools in one operation is also a reminder that these aren't separate problems. A loader, a RAT and a stealer in the same case is the normal arrangement, not a coincidence.

What remains unknown

The report doesn't say how many devices or organisations were compromised by the malware itself, only how many victims the seized logins belong to. It doesn't name the ransomware groups that received access from these tools. It doesn't say whether the operators were identified.

There's no published technical write-up in what we have, so there's nothing yet on which domains or hashes to hunt for, or whether any of the seized infrastructure was mirrored elsewhere.

Defensive priorities the evidence supports

The report supports a narrow set of checks. Look for Gootloader, CastleRAT and StealC on endpoints, since a server takedown doesn't remove an implant. Treat credentials stored on or used from any host that ran a stealer as exposed, and rotate them. If the BKA or a national CERT publishes victim notifications or indicators, those are worth reading before assuming you're outside the affected group.

Everything past that would be guesswork. The advisory-level detail isn't in this report, and we'd rather say so than fill the gap.