Europol Takes Down 235 Servers and 257 Domains Linked to Gootloader, CastleRAT, and StealC Malware

Europol and international partners have disrupted infrastructure linked to Gootloader, CastleRAT, and StealC, targeting malware services that support ransomware attacks and data theft. Announced on November 12, 2026, the latest Operation Endgame action covered 235 servers and 257 domains. Authorities also recovered 6.4 million victim datasets from criminal infrastructure.

The operation targeted the cybercrime-as-a-service model, where criminals supply tools or access that other attackers use to breach networks. These services connect infections to password theft, remote control, and ransomware deployment. Removing their servers and domains disrupts several stages of that chain rather than targeting only the final ransomware payload.

Gootloader and CastleRAT Infrastructure Disrupted

Gootloader drew victims through fake legal documents hosted on compromised websites, including hacked WordPress sites. Authorities reported taking down 14 servers and 218 domains while cleaning 681 infected websites. Earlier reporting on Gootloader’s search poisoning techniques explains how fake forum pages and search results steer users toward malicious JavaScript downloads.

That delivery method turns an ordinary search for a contract or business agreement into an entry point for attackers. After execution, Gootloader can bring additional tools into the system. Its role as a loader makes it important to ransomware operators, who can use the access to prepare later attacks.

CastleRAT, known since 2025, gives attackers remote control over infected computers. Authorities reported seizing 120 servers and 39 domains connected to the malware. Previous CastleRAT technical coverage described Python and C versions, with capabilities including keylogging, screen capture, and clipboard monitoring. These functions help attackers collect information and maintain access.

Stolen Credentials and Victim Notifications

StealC targets passwords, saved login details, and digital identities, with stolen data feeding fraud and further attacks. Authorities reported dismantling 102 servers linked to the malware. This follows Europol’s June 2026 operation, which also targeted StealC alongside SocGholish and Amadey, showing continued pressure on the same criminal service.

The published malware figures total 236 servers, one more than the overall figure of 235. Without a published explanation, that difference remains unresolved. The domain figures match the stated total of 257. This distinction matters when assessing the operation’s reported scale.

Victim data will support alerts through services including Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, Shadowserver, and NL-NCSC. Europol’s European Cybercrime Centre supported intelligence work, financial tracing, and victim notifications, while Eurojust helped judicial authorities coordinate their actions.

WordPress owners are urged to change credentials, enable multifactor authentication, and patch vulnerabilities. Removing unknown accounts and keeping sites updated also reduces reinfection risk. The takedown disrupts criminal infrastructure, but affected users still need to secure exposed accounts and systems.

The post Europol Takes Down 235 Servers and 257 Domains Linked to Gootloader, CastleRAT, and StealC Malware appeared first on Cyber Security News.