Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified
Severity: medium · Patch status: no-fix-needed · Since 2026-11-12
Police in nine countries, working with Europol, took down the infrastructure behind the Gootloader loader, the CastleRAT remote-access trojan and the StealC infostealer, seizing 235 servers and 257 domains in total. Gootloader lost 14 servers and 218 domains; its victims were often infected through hacked WordPress sites that carried fake legal-document lures. CastleRAT lost 120 servers and 39 domains, and StealC lost 102 servers as part of work that continues action begun in June 2026. Europol says over six million victim credentials were identified in criminal infrastructure, and that the stolen logins were being sold for later attacks such as ransomware. Victim data tied to CastleRAT will be made available for notification through Have I Been Pwned and partner services, and 681 infected websites were remediated. Europol urges WordPress site owners to change credentials, enable multi-factor authentication and patch. No vendor patch applies; remediation is credential rotation and web-hosting hygiene.
What to do
- Change WordPress credentials and enable multi-factor authentication immediately, per Europol guidance
- Patch WordPress sites and plugins promptly to prevent compromise via fake-document campaigns
- Check Have I Been Pwned and enterprise credential-exposure services for CastleRAT-related alerts
- Rotate any credentials that may have been harvested from infected endpoints; audit for StealC/CastleRAT indicators
- Review e-mail and web-filtering controls against fake legal-document lures used by Gootloader
Sources
All live incidents on Threat Watch
