Operation Endgame Hits Gootloader, CastleRAT and StealC
An international operation against malware networks took hundreds of servers and domains offline. Authorities also seized millions of credentials originating from tens of thousands of victims.
Operation Endgame Gootloader targeted the infrastructure of the Gootloader, CastleRAT and StealC malware families. The international action, supported by Europol, took place from November 9 to 11, 2026, and authorities announced it on November 12. The targets were services used to infect devices, remotely control them and steal credentials.
Europol said the operation affected 235 servers and 257 domains. Germany’s Federal Criminal Police Office (BKA) confirmed more than 230 servers, over 250 domains and the cleanup of more than 680 compromised websites. The U.S. Department of Justice separately confirmed a court-authorized operation against Gootloader involving more than 100 servers and the seizure of domains in the United States.
Operation Endgame Gootloader Disrupted the Attack Chain
The three targeted tools performed different roles. Gootloader was used for initial infection and, according to U.S. authorities, has a confirmed link to subsequent ransomware attacks. CastleRAT provided attackers with remote control of compromised devices. StealC is malware designed to steal data, including credentials.
The combination of these tools allows attackers to move from compromising a device through collecting passwords to further abuse of access. In the Gootloader case, U.S. authorities documented at least 44 victims in the United States and approximately $28.8 million in damages associated with ransomware attacks.
Millions of Credentials Seized
The BKA said approximately 6.4 million credentials originating from more than 40,000 victims were seized during the operation. Europol referred to more than six million identified credentials. Authorities said they would share the collected data with several services used to notify victims, but they did not disclose the full scope or schedule of the notifications.
The operation therefore does not mean that the malware has disappeared from all previously infected computers or that the stolen data can no longer be misused. For individuals and organizations with reason to believe they have been compromised, it remains important to check devices, remove the infection, change passwords and enable multifactor authentication (MFA).
The Difference in Server Counts Remains Unexplained
Europol published a total of 235 affected servers. However, its breakdown by malware family lists 14 servers for Gootloader, 120 for CastleRAT and 102 for StealC, for a total of 236. Authorities have not yet explained why the figures do not match.
It is also unconfirmed whether this phase of the operation resulted in arrests or charges against specific operators. The BKA also said that actions against the StealC infrastructure would continue.
What to Watch After the Operation
- the publication of any charges, arrests or court documents,
- the addition of data to victim-notification services, including Have I Been Pwned,
- new indicators of compromise from security partners,
- any restoration or relocation of the infrastructure by attackers.
The operation may temporarily limit campaigns using these specific services and the misuse of stolen credentials. However, system operators should continue monitoring for possible signs of compromise, because removing the central infrastructure alone does not clean already infected devices.
Sources
- Europol – Confirms the operation against Gootloader, CastleRAT and StealC, 235 servers, 257 domains and the identification of more than six million credentials.
- Bundeskriminalamt / ZIT – Confirms the operation dates, approximately 6.4 million credentials from more than 40,000 victims, cleaned websites and the continuation of action against StealC.
- U.S. Department of Justice – Confirms the U.S. court-authorized action against Gootloader, more than 100 servers and documented ransomware damages in the United States.
- Netherlands Police – Independently confirms the technical scope of the operation, the cleanup of 681 websites and the gradual sharing of victim data.
Verified and updated: November 13, 2026, 15:21
