"During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week," Europol said.
Europol and nine countries seize servers and domains
Europol, Eurojust and law enforcement partners from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States coordinated a cross-border disruption that removed pieces of three malware operations. Working with private partners, the authorities seized 257 domains and 235 servers tied to the Gootloader, CastleRAT, and StealC malware families. Europol described the effort as a stage of Operation Endgame, the international campaign targeting cybercrime and "cybercrime-as-a-service" networks.
What Gootloader, StealC, and CastleRAT did on victim systems
The three malware families taken offline played distinct roles in criminal ecosystems. According to the reporting, Gootloader is a malware loader that has been active since 2020; StealC is an infostealer designed to exfiltrate credentials, cryptocurrency wallets, and other sensitive information from infected devices; and CastleRAT is a remote access trojan that surfaced last year. Europol said all three have been used by various cybercriminal operations, including ransomware gangs.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageRecovered data: scale and next steps for notification
Law enforcement identified 6.4 million victim datasets on the targeted infrastructure, data that investigators say was stolen from malware-infected systems and used to fuel other cyberattacks. Europol's public statement reiterated that the suspects were using those credentials to sell them and to enable follow‑on attacks such as ransomware. Authorities said that victim data will be made available through a set of named platforms — HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL‑NCSC — so individuals and administrators can be alerted to stolen credentials.
Separately, the action included direct public safety guidance for WordPress users: update credentials, enable multi‑factor authentication, and patch vulnerabilities. Those recommendations mirror the channels and remedial steps Europol said will be used to mitigate harm from the seized datasets and infrastructure.
Operation Endgame's recent record of takedowns
The Gootloader/CastleRAT/StealC action is the latest in a sequence of Operation Endgame disruptions. In June — described in Europol's timeline — law enforcement cleaned nearly 15,000 malware‑infected WordPress websites and seized 106 servers used by the SocGholish botnet and the Evil Corp Russian cybercrime group. Later that month, Operation Endgame disrupted infrastructure used by Amadey and StealC, taking down 326 servers and 142 domains and recovering about 27 million credentials stolen from more than 385,000 compromised systems. One year ago, the operation reportedly removed over 1,000 servers used by Rhadamanthys, VenomRAT, and Elysium botnet operations. Previous targets named in the campaign include Smokeloader, DanaBot, IcedID, Pikabot, Trickbot, Bumblebee, SystemBC, the AVCheck site, and ransomware infrastructure.
What this means for security teams, WordPress administrators, and law enforcement partners
- Technologists and security teams: the recovery and publication of millions of datasets through named notification platforms will be an immediate input to credential‑monitoring and incident response efforts; teams should expect a surge of alerts from those services tied to the seized infrastructure.
- WordPress administrators and small site owners: Europol's advisory is explicit — change passwords, enable multi‑factor authentication, and apply patches — because WordPress sites have been a consistent vector in prior Operation Endgame actions and were specifically referenced in the June cleanups.
- Law enforcement and private partners: the operation underlines a recurring model: cross‑border coordination with private sector identification, takedown, seizure, and blocking. The listed takedowns and the platforms chosen for victim notification indicate a continuing partnership model between investigators and external reporting and remediation services.
The seizure removes hosting and domain infrastructure that enabled credential theft and follow‑on attacks, but Europol's own count — millions of stolen credentials and datasets already harvested — underscores that disruption of infrastructure is only one phase of the response. The authorities have routed recovered data to public notification platforms and urged practical fixes for exposed WordPress users; whether that combination reduces downstream abuse will be measurable only as victims respond to alerts and administrators close the exploited pathways. For now, Operation Endgame has added another set of takedowns to a growing list — and the platforms chosen to publish the recovered data will determine how quickly individuals and organizations can act.
Source: BleepingComputer — Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
