235 Servers Seized as Global Strike Guts Three Malware Networks

THE HAGUE, Netherlands — Europol and law enforcement partners in nine countries dismantled the criminal infrastructure behind the Gootloader, CastleRAT and StealC malware networks in the latest Operation Endgame strike, seizing 235 servers and 257 domains, Europol announced on November 12, 2026.

Read the Europol release: https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks

The coordinated actions severely crippled the three malware distribution networks, according to the release.

The operation targeted cybercrime-as-a-service models, in which the tools enabled further crimes including ransomware attacks and data theft, according to the release.

Authorities acted on the servers and domains together with private-sector partners, according to the release.

Gootloader, CastleRAT, And StealC Networks Dismantled

Gootloader is a loader that gained unauthorised access to computer systems by distributing fake legal documents through compromised websites, often hacked WordPress sites, according to the release.

Victims who downloaded the documents became infected, and the access led to further crimes including ransomware installed for digital extortion, according to the release.

In the Gootloader action, 14 servers and 218 domains were taken down, and 681 infected websites were remediated, according to the release.

CastleRAT is a remote access trojan known since 2025 that lets attackers control an infected computer from a distance, according to the release.

The tool was built to be deployed flexibly and to evade detection, and its use encrypted data sets, crippled whole IT systems and forced companies and organisations to pay ransoms, according to the release.

In the CastleRAT action, 120 servers and 39 domains were seized, with victim data shared for alerts, according to the release.

StealC is a stealer with a dropper function that extracts passwords, stored access data and digital identities from compromised computers for data trading and fraudulent use, according to the release.

In the StealC action, 102 servers were dismantled, continuing efforts that began in June 2026, according to the release.

6.4 Million Victim Datasets, Stolen Credentials, And Victim Alerts

During the action, more than 6 million victim credentials were identified in the criminal infrastructure seized by authorities this week, according to the release.

The suspects had stolen the credentials from infected victims to sell them for use in later cyber attacks such as ransomware, according to the release.

Victim data will be made available through Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC to alert victims of credentials stolen through the CastleRAT malware, according to the release.

WordPress users were urged to update their credentials, enable multi-factor authentication and patch vulnerabilities, according to the release.

Nine Countries, EC3 Support, And The Largest Ransomware-Enabler Effort

The participating countries were Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, according to the release.

United States participants included the Defense Criminal Investigative Service, the FBI Denver Division, the Army Criminal Investigation Division and the Justice Department's Computer Crime and Intellectual Property Section, according to the release.

Other participating agencies included the Royal Canadian Mounted Police, Germany's Federal Criminal Police Office, the Netherlands Police and Public Prosecution Office, Poland's Central Cybercrime Bureau and the United Kingdom's National Crime Agency, according to the release.

Europol's European Cybercrime Centre provided cyber intelligence, financial tracing and victim notification support, and Eurojust helped judicial authorities exchange information and synchronise actions, according to the release.

Operation Endgame is described in the release as the largest-ever international effort against ransomware enablers, with more than 30 public and private partners.

Anyone who believes their credentials may have been stolen can check whether their data appears through Have I Been Pwned and the other alerting platforms named in the release, and WordPress site owners should update credentials, turn on multi-factor authentication and patch vulnerabilities.

Sources Europol — Official News Release, November 12, 2026: https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks