Operation Endgame: scope, partners, and scale
Europol described the effort as Operation Endgame and said it involved agencies from nine countries — Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States — working alongside Europol and Eurojust. The agency called it the largest international effort against ransomware enablers and said more than 30 public and private partners participated. In total, investigators seized 235 servers and 257 domains tied to the criminal infrastructure supporting three distinct malware kits.
CastleRAT: remote access trojan and the largest seizures
The largest single law-enforcement action focused on CastleRAT, a remote access trojan that authorities have tracked since 2025. CastleRAT gives attackers remote control of infected machines and incorporates anti-detection mechanisms that made it difficult to identify. Police seized 120 servers and 39 domains connected to the tool as part of the operation.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageGootloader and WordPress abuse: initial access and measured impact
Gootloader served as an initial access vector through a dropper delivered in fake legal documents hosted on compromised WordPress sites. Authorities took down 14 servers and 218 domains associated with Gootloader and cleaned up 681 infected websites. According to the U.S. Department of Justice, Gootloader has infected at least 25,000 computers around the world, featured in ransomware attacks against at least 44 U.S.-based victims, and has been linked to approximately $28.8 million in losses since 2018.
StealC and stolen credentials: more than 6 million victims identified
Investigators dismantled 102 servers tied to StealC, a stealer with dropper functions designed to extract passwords, data and credentials for resale and fraud. The seized infrastructure held more than 6 million sets of victim credentials, and authorities identified credentials belonging to 6.4 million victims in total. Those credentials, the announcement said, were collected after victims were infected and were offered for sale to enable further attacks, including ransomware.
What this means for WordPress users, security teams, and victims
- WordPress users: Authorities advised updating credentials, enabling multi-factor authentication, and patching vulnerabilities — the specific mitigations named in the announcement.
- Security teams and incident responders: Victim data seized in the operation will be shared through known channels so organizations can check for exposures; Europol and partners said the data will be made available via platforms including HaveIBeenPwned, the Shadowserver Foundation and the Dutch National Cyber Security Centre.
- Victims and the general public: With 6.4 million credentials identified and more than 6 million credential sets held in the seized infrastructure, those affected will have a route to confirm compromise through the named platforms and are directly urged to change credentials and enable multifactor protections.
The takedown highlights a concentrated strike at the “cybercrime-as-a-service” market, where distinct actors build and maintain malware toolkits that are then rented or sold to others who carry out intrusions, extortion and fraud. Authorities noted that the infrastructure enabled a chain of criminal activity: initial access delivered by droppers such as Gootloader, persistent remote control provided by tools like CastleRAT, and mass harvesting and resale of credentials through stealers like StealC.
Law enforcement framed the operation as cumulative: the StealC seizures built on actions taken in June 2026, and this multinational effort has been active since 2024 with a stated focus on removing malware that underpins large numbers of financially motivated crimes. For victims and defenders, the immediate next step identified by authorities is the publication of the compromised credentials through the named notification platforms so individuals and organizations can take concrete remedial steps.
As investigators turn infrastructure over to victim-notification channels and clean up compromised sites and domains, the operation leaves a clear, operational question in its wake: will making millions of exposed credentials searchable through HaveIBeenPwned, Shadowserver and national centres materially reduce follow-on fraud, or merely shift where defenders look for the next compromise? Authorities have provided a path for affected parties to learn whether their credentials were taken — and for now, that path is the practical outcome of the largest international effort against known ransomware enablers.
