Law enforcement agencies around the world have dealt a significant blow to three notorious malware families, seizing infrastructure and disrupting their operations. The joint effort, part of Operation Endgame, targeted Gootloader, CastleRAT, and StealC, which were used to facilitate ransomware attacks, data theft, and other cybercrime activities.
The investigators seized 235 servers and 257 domains associated with the malicious operations, severely crippling their distribution networks, according to Europol. This move is expected to significantly impact the malware families’ ability to spread and carry out attacks. Gootloader, in particular, has been active since at least 2018 and has infected over 25,000 computers, causing damages of approximately $28.8 million in the US.
Gootloader operates under a cybercrime-as-a-service model, using compromised websites containing fake legal documents to distribute other malware families, including ransomware. The malware dropper was active on 100 servers before law enforcement removed it. Europol reports that 14 servers and 218 domains associated with Gootloader were seized, and 681 infected websites were cleaned up.
CastleRAT, a remote access trojan (RAT) that has been active since at least 2025, allowed threat actors to control infected machines, which were then used to deploy file-encrypting ransomware. Law enforcement seized 120 servers and 39 domains used by CastleRAT’s operators, as well as victim data. This included 180,000 email addresses and 893,000 unique passwords, which have been shared with HaveIBeenPwned.
StealC, a malware family that has been active since at least 2023, functions as both a stealer and a dropper. Its primary focus is on password, data, and identity theft. In the latest law enforcement action targeting StealC, 102 servers were disrupted, leading to the seizure of 6.4 million victim credentials. These credentials have been shared with various organizations, including HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC.
The seized credentials will help prevent their reuse in future attacks, according to Europol. “The suspects were using these credentials, stolen from the victims after they infected them, to sell them and later be used for other cyber-attacks such as ransomware,” the agency notes. The joint effort demonstrates the growing collaboration between law enforcement agencies worldwide to combat cybersecurity threats.
For individuals and organizations, this operation serves as a reminder of the importance of staying vigilant in the face of evolving malware threats. It’s essential to keep software up-to-date, use robust security measures such as antivirus programs and firewalls, and remain cautious when interacting with unknown websites or documents. By being proactive in cybersecurity efforts, we can mitigate the impact of these types of attacks and protect our digital assets.
Source: SecurityWeek — 2026-11-13