MAG212 CYBER ORIGINAL ARTICLE

Operation Endgame Takes Down Gootloader, CastleRAT and StealC Infrastructure and Recovers Over 6 Million Credentials

November 13, 2026 · El Mostafa Ouchen

MAG212 CYBER illustration: three malware network nodes around a central seized badge, headline 'Three malware networks disrupted'.

The latest phase of Operation Endgame went after three of the tools that sit at the start of many ransomware attacks: Gootloader, which lures people into downloading fake legal documents; CastleRAT, a remote-access trojan; and StealC, a credential stealer. Europol says agencies from nine countries, working with private partners, actioned 235 servers and 257 domains and identified more than 6 million stolen credentials. Victims will be told through Have I Been Pwned and other notification services. Europol mentions no arrests.

Actioned235 servers, 257 domains
CredentialsOver 6 million identified (6.4M datasets)
WordPress681 infected sites remediated
NotificationHIBP, DIVD, Shadowserver, NL-NCSC and others

What happened

[Confirmed] Europol says law enforcement and private partners actioned 235 servers and 257 domains behind three “cybercrime-as-a-service” tools. Germany’s BKA dates the action to 9–11 November. Agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK and the US took part, with Europol’s EC3 and Eurojust. Europol mentions no arrests. (Europol) (BKA)

Bar chart: Gootloader 14 servers and 218 domains, CastleRAT 120 servers and 39 domains, StealC 102 servers; totals 235 servers, 257 domains, over 6 million credentials.
Figure 5 · Operation Endgame by the numbers. Servers and domains actioned per malware family, from Europol’s release. Diagram: MAG212 CYBER

Who is affected and how the tools work

[Confirmed] Gootloader spread through fake legal documents on hacked, often WordPress, sites and led on to ransomware: 14 servers and 218 domains came down and 681 infected websites were cleaned. CastleRAT, a remote-access trojan known since 2025, was linked to encrypted data and ransom payments: 120 servers and 39 domains were seized, with victim data shared for alerts. StealC, a credential stealer with a dropper, lost 102 servers, continuing a June 2026 action. Victims of stolen CastleRAT credentials will be alerted through HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and NL-NCSC. (Europol)

What to look for and do

  1. Watch the notification channels. Check your domains with Have I Been Pwned domain search, and your Shadowserver reports if you subscribe.
  2. [MAG212 analysis] For each validated hit: isolate the device, reset passwords from a clean machine, and revoke sessions and tokens, because stealers take cookies as well as passwords. Then review MFA methods, mailbox rules and OAuth grants for the account.
  3. [MAG212 analysis] Hunt Gootloader: look for a browser download of a .zip followed by wscript.exe or cscript.exe running a .js file, and for new scheduled tasks soon after.
  4. WordPress owners: Europol urges updated credentials, MFA and patching. Also verify core, plugins and themes against clean copies.

Verify recovery: old sessions are rejected, no new sign-ins from unknown locations, and the rebuilt device is clean. Prevention: see this issue’s awareness lesson on downloading templates safely.

What a takedown does and doesn’t do

[MAG212 analysis] Seizing servers and domains breaks the operators’ infrastructure and gives investigators the data on it, including stolen credentials and victim lists. It doesn’t clean infected computers, and it doesn’t make stolen passwords or session cookies stop working. Those still have to be reset and revoked by the organisations they belong to.

[MAG212 analysis] Past Endgame phases have shown that operators rebuild, sometimes within weeks. The lasting value of an action like this is the victim data it recovers and the notifications that follow, which tell organisations about compromises they would otherwise never have found.

[Confirmed] Gootloader relied on hacked websites, many running WordPress, to host its lures. Europol says 681 infected sites were cleaned and urges site owners to update credentials, turn on multi-factor authentication and keep software patched.

Why it matters

Loaders, remote-access trojans and infostealers are how many ransomware intrusions begin. Stolen credentials and session cookies let attackers log in as real users, often bypassing multi-factor authentication. A notification that your users’ credentials were in this haul is a warning that someone may already have used them.

The bottom line

Check your domains in Have I Been Pwned and watch Shadowserver and national CERT notifications. For each confirmed victim, isolate the device, reset passwords from a clean machine and revoke sessions and tokens. Hunt for the Gootloader pattern of a ZIP download followed by a script running, and if you run WordPress, check it against clean copies and enforce MFA for admins.

How we label evidence: [Confirmed] comes from a primary source such as a vendor or CISA; [Reported] from a secondary outlet; [Claimed] from an attacker or an unverified party; [MAG212 analysis] is our judgement; [Unknown] means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.

This story is part of MAG212 CYBER Daily, 13 November 2026, with the day’s other verified stories, the Defender’s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER. By El Mostafa Ouchen.