Police Seize 235 Servers and 257 Domains in Operation Endgame Action Against Gootloader, CastleRAT and StealC

Law enforcement agencies in the US, Europe, Australia and Canada have seized infrastructure behind Gootloader, CastleRAT and StealC, according to SecurityWeek's report on the operation, published on 13 November 2026. Investigators took 235 servers and 257 domains, Europol says, and the seized material includes 6.4 million victim credentials.

All three are sold or run as a service. Gootloader drops other malware, ransomware included. CastleRAT gives an operator remote control of a machine, which the report says was then used to push file-encrypting ransomware. StealC steals passwords, data and identities, and doubles as a dropper.

What was seized

The headline numbers are totals across the three families, and the per-family figures don't add up to them cleanly, which is worth keeping in mind when quoting any single one.

• Gootloader: 14 servers and 218 domains seized, 681 infected websites cleaned up, and the dropper removed from 100 servers, per Europol and the DoJ. The DoJ says Gootloader has been active since at least 2018, has infected over 25,000 computers and caused roughly $28.8 million in damages in the US.
• CastleRAT: 120 servers and 39 domains seized, plus victim data. HaveIBeenPwned says 180,000 email addresses and 893,000 unique passwords were recovered from it. The report dates CastleRAT's activity to at least 2025.
• StealC: 102 servers disrupted, continuing action taken against the malware earlier this year. StealC has been around since at least 2023.

The 6.4 million credentials have been shared with HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC. Europol's line on why: suspects were selling the stolen credentials, which were then used in other attacks, ransomware among them.

How the pieces fit

Gootloader's delivery trick is the part defenders see most often. It arrives through compromised websites dressed up as legal documents, so the lure is a search result or a link a person has a reason to click, not an attachment from a stranger. Once it runs, it fetches whatever the operator wants next. That makes it a supply line rather than a payload, and taking servers away from it interrupts other people's campaigns too.

CastleRAT is the opposite end of the same chain. Someone with remote control of a host can move to the next machine, find the backups, and run the encryptor. StealC sits in the middle: it harvests credentials, which get sold and reused. The three feed each other, which is why one operation covered all of them.

HackZoneLabs assessment

Seizure counts are a poor measure of damage to a criminal business, and this report doesn't try to measure it. Europol's "severely crippling" is the agency's characterisation, not a finding anyone has published evidence for. What we can say is that the credential handover is the most useful part of this for defenders: 6.4 million sets of stolen logins now sit with groups that run notification services, and the operators were reportedly selling them on for follow-on attacks. In our view, the practical value of this takedown lands less in the server count and more in the fact that those credentials are now in the hands of people who will tell the account holders.

We'd also treat the Gootloader numbers with some care. "Removed from 100 servers" and "14 servers seized" describe different things, and the report doesn't reconcile them. Neither does it say whether the operators are identified, charged or still at large.

What remains unknown

The report gives no timeline beyond the publication date, no statement on arrests, and no indication of how much of each operation's capacity survived. It doesn't say whether CastleRAT or StealC have resumed, or whether the seized servers held data on victims beyond the credentials counted. The DoJ damage figure for Gootloader covers the US only, and the report doesn't break it down.

What to check

If your organisation has been hit by ransomware in the past few years, the credential dump is the reason to look again at accounts that were reset around the time of an incident, and at any that weren't. Password reuse across work and personal accounts is the exposure StealC was built for. For Gootloader, the lure is a fake legal document reached through a compromised site, so the useful control is what runs after a user opens a downloaded file, not the search result itself. HaveIBeenPwned and the other named services are where the notification traffic will show up.