Police in nine countries have seized 235 servers and 257 domains used by three malware operations, Gootloader, CastleRAT and StealC, and recovered 6.4 million datasets stolen from victims. Europol announced the action on 12 November as the latest phase of Operation Endgame, its international campaign against the services that give ransomware gangs their way into a network.

The countries involved were Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, with Europol and Eurojust coordinating the effort alongside private-sector partners. The measures ran from 9 to 11 November, according to German police material reported in coverage of the operation.

What each malware operation lost

Gootloader, a malware loader active since 2020 that draws victims in through fake legal documents hosted on compromised websites, including hacked WordPress sites, lost 14 servers and 218 domains. Authorities also cleaned 681 infected websites used to spread it.

CastleRAT, a remote access trojan that gives attackers remote control over infected computers, lost 120 servers and 39 domains. StealC, an infostealer that takes passwords, saved login details, cryptocurrency wallets and other sensitive information from victims' devices, lost 102 servers. The StealC action follows an earlier strike against the same malware in June 2026.

The 6.4 million stolen logins

One of the most significant results was the recovery of about 6.4 million victim datasets from the seized infrastructure. Reporting on the operation put the human scale at more than 40,000 victims. Europol said data linked to CastleRAT infections would be shared with breach-alert services, including Have I Been Pwned, so people can check whether their email address appears in the stolen data. Dutch police also pointed victims to politie.nl/checkyourhack.

Europol described the operation as targeting the cybercrime-as-a-service model, in which criminals supply the tools and access that other attackers use to break into networks, steal data and launch ransomware attacks. The suspects behind these services use stolen credentials to sell access onward for later attacks, including ransomware.

Disruption, not a final defeat

Operation Endgame began in 2024 and is described by Europol as its largest international effort against ransomware enablers, involving more than 30 public and private-sector partners. Europol said this week's action severely crippled the distribution networks behind the three malware families, but seizing infrastructure does not remove infections from computers already compromised, and it does not stop operators rebuilding. Europol's announcement did not mention arrests.

Anyone who suspects their computer was infected should change passwords, starting with email and banking, turn on two-factor authentication, and check their address on Have I Been Pwned. Europol's announcement, "6.4 million victim datasets secured in international operation against malware networks", was published on 12 November, and BleepingComputer reported the takedown the same day.