Operation Endgame Takes Down Gootloader, CastleRAT and StealC

Europol says law enforcement has dismantled infrastructure behind Gootloader, CastleRAT and StealC in the latest Operation Endgame action, with 235 servers and 257 domains actioned together with private parties. The Europol release is dated 12 November 2026. The German Federal Criminal Police Office (BKA) and the Frankfurt ZIT say the coordinated measures ran from 9 to 11 November.

The two official accounts agree on the families that were targeted and on the fact that this was another Endgame strike, but they use different wording for the number of victim credentials recovered. No arrests were announced in this phase. Europol lists the UK’s National Crime Agency among the participating agencies, alongside partners in Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland and the United States, plus Eurojust.

Europol and the BKA give different credential figures

Europol’s release is headlined “6.4 million victim datasets secured” and includes a section titled “6.4 million victim credentials identified.” In the body, it says “over 6 million victim credentials were identified” in the criminal infrastructure seized during the week. The BKA, in its joint statement with the ZIT, says around 6.4 million credentials from over 40,000 victims were secured. Those are two official figures, not one, and only the BKA gives a victim count.

The infrastructure totals also differ in how tightly they are drawn. Europol says 235 servers and 257 domains were actioned. The BKA says over 230 servers were subjected to measures, more than 40 of them in Germany, and that over 250 command-and-control domains were taken out of service and over 680 compromised websites were cleaned. Europol then splits the work by family: 14 servers and 218 domains taken down and 681 infected websites remediated for Gootloader; 120 servers and 39 domains seized for CastleRAT; and 102 servers dismantled for StealC, continuing efforts from June 2026.

Europol says Gootloader was distributed as fake legal documents through compromised websites, often hacked WordPress sites, and that this access was used to install further crimeware, including ransomware. The BKA says Gootloader has been spread since 2020 by SEO poisoning, and that Germany was among the countries most heavily affected. CastleRAT, known since 2025, is described as a remote access trojan. StealC is described as a stealer, used to lift passwords and other stored credentials.

The BKA also says a substantial part of the StealC infrastructure had been hosted at the bulletproof provider Virtualine/Omegatech, which the Frankfurt police and the Dutch NHTCU had already shut down at the end of October 2026. That earlier step is the subject of TSN’s report on the Virtualine domain seizure. Other recent takedowns on TSN include the XCPE botnet action led by Google and its partners and a Brooklyn DA and FBI disruption of servers and domains behind a crypto scam.

Endgame’s wider record is not this week’s arrest list

Operation Endgame was launched in 2024. The BKA says that, since the start, 17 malware families have been taken down, 47 arrest warrants have been issued and over €270 million in assets have been seized or frozen. Those are cumulative figures for the operation as a whole. They are not a description of arrests, warrants or seizures announced for the 9–11 November action, and none were announced in this week’s Europol or BKA notices.

Europol says victim data from this action will be made available through HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and the Dutch NCSC, and that the alerts concern credentials stolen through CastleRAT. It also urges WordPress users to update credentials, turn on multi-factor authentication and patch known flaws.

Carsten Meywirth, head of the BKA’s cybercrime division, said in the German release, in a TSN translation, that the authorities, together with international partners and private cybersecurity companies, can also take down malware that had seemed untouchable, and that anyone who rebuilds infrastructure after police measures leaves new traces, which investigators will follow.

A large takedown is not the same as a closed case

The useful facts are the ones the two agencies actually published, kept apart where they diverge. Europol gives exact server and domain counts, and a family-by-family split, and speaks of over 6 million victim credentials, while dressing the same release with a 6.4 million headline. The BKA gives rounded infrastructure totals, a German share, a website-cleanup figure and a more specific credentials claim: around 6.4 million from over 40,000 victims. Treating those as a single official number would hide a real difference in the record.

What both sides do say, clearly, is that Gootloader, CastleRAT and StealC infrastructure was hit in a coordinated window from 9 to 11 November, that private firms took part, and that this phase did not come with a new arrest announcement. The lifetime Endgame score — 17 families, 47 warrants, more than €270 million frozen or seized — belongs to the years since 2024, not to this week alone. For people trying to find out whether their own passwords were in the haul, the practical next step is the victim-notification routes Europol named, not a headline figure. The next test of the operation is whether the same families reappear on new infrastructure, which is the risk Meywirth was pointing to when he talked about traces left by a rebuild.

Sources

1. Europol, “6.4 million victim datasets secured in international operation against malware networks,” 12 November 2026. https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks
2. Bundeskriminalamt and Generalstaatsanwaltschaft Frankfurt am Main (ZIT), “Operation Endgame goes against several malware variants: Gootloader, CastleRAT and StealC taken down,” 12 November 2026. https://www.presseportal.de/blaulicht/pm/7/6389442

Related stories

FBI Seizes Virtualine Domain as Dutch Police Take Servers Offline is the nearest TSN account of the Virtualine/Omegatech shutdown the BKA says preceded this StealC action.

Also relevant:

• Google and Partners Take Down XCPE Botnet on 1.3m Set-Top Boxes
• Brooklyn DA and FBI Disrupt 112 Servers and 241 Domains Behind a Crypto Scam Targeting Russian Speakers