Police Took Down Gootloader, CastleRAT and StealC and Seized 6.4 Million Stolen Logins. The Logins Still Work. Clean, Then Reset, Then Check.
Police in nine countries took down servers behind three malware families this week, and found about 6.4 million stolen logins on them. Seizing the servers does not change a single one of those passwords. If your organization's logins were in that pile, they still work for anyone who copied them before the servers came down. This week: subscribe your domains to Have I Been Pwned and Shadowserver, and when a hit lands, clean the machine first, then reset the password and revoke sessions from a clean device. If you run WordPress, change every admin password and turn on MFA. And delete any "police" email that asks you to click a link to check your data. The Dutch police say they never send one.
What is confirmed
Five official sources, read on November 13: Europol's press release, the joint release from Germany's Federal Criminal Police Office (BKA) and the Frankfurt cybercrime prosecutors (ZIT), the U.S. Justice Department's release on Gootloader, the Netherlands Police release, and the Dutch police Check your hack page and its FAQ.
When and who. The BKA release says the action ran November 9 to 11, 2026. Europol published on Thursday, November 12, and lists police and prosecutors from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, with Europol and Eurojust coordinating. No arrests were announced.
What came down. Europol: "235 servers and 257 domains were actioned by law enforcement together with private parties." Its per-family figures:
Gootloader, a loader that spreads "fake legal documents through compromised websites," often hacked WordPress sites: "14 servers and 218 domains were taken down; 681 infected websites remediated."
CastleRAT, a remote access trojan "known since 2025," which Europol says led to encrypted data, crippled IT systems and ransom payments: "120 servers and 39 domains were seized, with victim data shared for alerts."
StealC, which Europol calls "a so-called stealer with dropper function" built to take "passwords, stored access data and digital identities": "102 servers were dismantled, continuing efforts from June 2026."
The stolen data. Europol says "over 6 million victim credentials were identified in the criminal infrastructure," and that the operators were selling them for use in further attacks such as ransomware. The BKA puts it at about 6.4 million login credentials belonging to more than 40,000 victims. That second number matters: this is not 6.4 million people. It is many saved logins per infected machine.
StealC was hit before and came back. We covered the June phase, which took down StealC and Amadey, in our June 25 post. The BKA says the operators rebuilt after June and the new infrastructure is what police hit this week. It also says StealC's main infrastructure ran on Virtualine/Omegatech, a bulletproof hosting service that Frankfurt police and the Dutch High Tech Crime Unit shut down in late October. The BKA's head of cybercrime, Carsten Meywirth, put it this way: whoever rebuilds after a police action "legt neue Spuren, denen wir nachgehen," leaves new traces, and police follow them.
Gootloader in the United States. The Justice Department says the operation removed Gootloader "from over 100 computer servers" and seized U.S. domains used to deliver and control it. It says Gootloader has infected at least 25,000 computers worldwide since 2018, was used in ransomware attacks on at least 44 U.S. victims, and caused about $28.8 million in losses. Its operators sold access to infected computers to ransomware crews. The Shadowserver Foundation worked with internet providers to find infected systems.
Where the victim data is going. Europol names Have I Been Pwned, DIVD, CheckjeHack, No More Leaks, Sekoia, the Shadowserver Foundation and NL-NCSC. The Dutch police say the data stolen by CastleRAT is in their Check your hack service, with more data to come in the coming weeks. In Germany, the BKA says the Federal Office for Information Security (BSI) warned the providers of infected systems and is helping notify victims.
What is not known
Whether your data is in it. Nobody can answer that from the press releases. The notification services are the only way, and the Dutch police say more data is still being loaded.
Which families the 6.4 million came from. Europol's victim-alert language names CastleRAT specifically. It does not break the credential total down by family.
How the counts line up. Europol's three per-family server counts add to 236 against its headline 235. The BKA says over 230 servers (more than 40 in Germany) and over 250 domains. The Justice Department's "over 100 servers" for Gootloader is a different number from Europol's 14, and we read it as a count of servers the malware was removed from, not attacker-run servers, but the release does not say. We quote each agency's figure as its own.
Who runs Gootloader. The Dutch police say further investigation "targeting the main suspect of Gootloader malware has been carried out." No one is named.
Indicators. None were published in the sources we read: no seized domain list, no IP addresses, no file hashes, from Europol, the BKA, the Justice Department, the Dutch police or operation-endgame.com. The Endgame site lists more than twenty private partners, including Proofpoint, Sekoia, Zscaler, abuse.ch, Spamhaus and Team Cymru. We searched for a partner write-up with indicators and did not find one as of this writing.
What to do this week
Subscribe, don't just look once. Have I Been Pwned lets a verified domain owner see every breached address on the domain and get alerts as new data loads. Shadowserver sends free reports to network owners about infected machines on their address space. Data from this operation is going to both, and more is coming, so a clean result today is not a clean result next week.
Individuals: Check your hack. The Dutch police service at politie.nl takes one email address at a time. If it is in the data, you get an email from the police within minutes with removal steps. If it is not, no email arrives. Check your spam folder. It does not check whole domains; the police say that would let anyone see other people's addresses.
Clean before you reset. A stealer or a RAT on the machine will take the new password the same way it took the old one. The Dutch police make the same point: criminals may still hold stolen logins after the seizure, and malware still on a machine keeps harvesting. Reimage or fully clean the machine, then change passwords from a different, clean device.
Revoke sessions, not just passwords. Stealers take saved logins and, by Europol's description, "digital identities." A password reset does not always end a session that is already open. Sign out all sessions and revoke tokens for the affected accounts in your identity provider and your key SaaS apps, and re-enroll MFA on any account where the second factor lived on the infected machine.
If you run WordPress, assume it could be one of the 681. Denmark's police cleaned 681 sites and say attackers likely got in with stolen passwords and then planted backdoors. The Dutch and Danish advice, as the press summarized it: change admin passwords to unique ones of at least 12 characters, turn on MFA, remove unknown admin accounts and unknown code, update WordPress, themes and plugins, and restrict /wp-admin to your own IP addresses. We could not load the Danish release directly (the connection was refused), so that list comes via The Hacker News; the Europol release independently says WordPress users should "update credentials, enable multi-factor authentication, and patch vulnerabilities."
Watch for the follow-on phishing. The Dutch police FAQ: "Unlike scammers (phishing), the Netherlands Police does not send emails containing links." An email claiming to be from police, Europol or a notification service that asks you to click through and check your data is the scam. Type the address yourself.
Plan for the rebuild. StealC came back after June. Our earlier piece, From 1 to 5: how we mapped a post-Operation Endgame C2 infrastructure, traced a stealer campaign that looked like a rebuild after an earlier Endgame phase. A takedown buys time. It does not retire the business model.
How we know, and what our feed holds
Every fact above comes from the five official sources listed below, read in full on November 13. Where they disagree, we say so and quote each.
We added nothing to our feed for this story. None of the sources we read published indicators, and we do not write seized or sinkholed infrastructure into a blocklist from a press release that names none. If a partner publishes a list, the honest handling is to score sinkholed domains low or leave them out: blocking a sinkhole hides the infected machines that are still calling it, which is the signal Shadowserver uses to find and notify victims.
What we already held, all of it third-party feed data rather than our own detection, counted on November 13 with exact-phrase search and filtered to records whose malware family actually matches:
Gootloader: 13 records, all from ThreatFox. Ten are xmlrpc.php URLs on WordPress sites, which fits the hacked-site delivery Europol describes; those sites are victims, not attacker-owned servers. Three are file hashes.
CastleRAT: 4 records, from ThreatFox and URLhaus: one IP and port, two download URLs, one hash.
StealC: roughly 1,950 records by search estimate. In a 200-record sample, 199 were attributed to StealC, all from ThreatFox or URLhaus, and most were ingested in March through May 2026, before the June takedown.
None of that is a lead on anyone. These are other people's indicators that we redistribute, and we cannot tell from them which of this week's 235 servers they touched.
We did not run an edge check. Nothing in the releases is a web exploit path our sensors could see, and our blog does not run WordPress.
Sources
Europol, "6.4 million victim datasets secured in international operation against malware networks: Gootloader, CastleRAT, and StealC malware targeted in latest Operation ENDGAME cyber strike," published November 12, 2026, 13:00 UTC (europol.europa.eu). Bundeskriminalamt and Generalstaatsanwaltschaft Frankfurt am Main (ZIT), press release on Operation Endgame, November 12, 2026 (presseportal.de, in German). U.S. Department of Justice, press release 26-1351, "Gootloader Malware Disrupted in International Cyber Operation," November 12, 2026 (justice.gov). Netherlands Police, "International action disables cybercriminal network," November 12, 2026, and the Check your hack page and FAQ (politie.nl). Operation Endgame, operation-endgame.com, read November 13.
Press leads, used to find the primary sources and for the Danish WordPress advice: BleepingComputer, "Police dismantles Gootloader, CastleRAT, StealC malware infrastructure," November 12, 2026, and The Hacker News, "Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins," November 13, 2026.
Our earlier Endgame coverage: June 25, 2026: StealC and Amadey and the post-Endgame C2 mapping.
The takedown is the work of the agencies and partners named above. The counts of what our corpus holds are ours, taken November 13, 2026. We cap ourselves at 95 percent confidence.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Comments