A new wave of the international police operation Endgame has taken down the infrastructure of three malware families, Gootloader, CastleRAT and StealC: 235 servers and 257 domain names were seized. According to BleepingComputer, which relays Europol, 6.4 million victim data sets were recovered, including more than 6 million credentials. Businesses would do well to check whether their accounts are among them.
What was seized
The action, made public on 12 November, was coordinated by Europol and Eurojust with agencies from nine countries: Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States. Private partners helped identify and then block the machines used by the criminals. No arrests have been mentioned at this stage.
LeMagIT, which presents the operation as the first episode of Endgame’s “season 4”, breaks down the results by malware family:
- Gootloader: 14 servers and 218 domains neutralised, along with the clean-up of 681 compromised WordPress sites;
- CastleRAT: 120 servers and 39 domains;
- StealC: 102 servers, following on from earlier actions against this data stealer.
Again according to LeMagIT, which draws on a video posted on the operation’s website, it all started with the compromise of a Gootloader administration panel hosted in South Africa.
Three tools, one criminal chain
These programs do not play the same role, but they complement each other. Gootloader is a “loader”: its job is to open the door to other malware. It has been circulating since at least 2020 according to available documentation, and since 2018 according to law enforcement. Its modus operandi, described by LeMagIT, relies on search engine poisoning: the victim clicks on a page, often a hacked WordPress site, and downloads a Zip archive containing JavaScript. Opening the file launches PowerShell commands that take control of the computer, which then becomes an entry point into the company’s network.
StealC is an information stealer: it harvests credentials, cryptocurrency wallets and other sensitive data stored on the infected machine. CastleRAT, which appeared in 2025, is a remote access Trojan that allows the compromised machine to be controlled remotely. According to BleepingComputer, all three families have been used by various criminal gangs, including ransomware groups. LeMagIT recalls that in 2024, Microsoft observed the actor Vanilla Tempest exploiting access obtained through Gootloader to deploy Vice Society ransomware, and later INC ransomware.
An operation that has been running for months
Endgame proceeds in successive waves. BleepingComputer recalls several of them: in June 2026, nearly 15,000 infected WordPress sites were cleaned up and 106 servers linked to SocGholish and Evil Corp were seized. Another action, later the same month, targeted Amadey and StealC, taking 326 servers and 142 domains offline and recovering some 27 million credentials from more than 385,000 compromised systems. A year before the November 2026 wave, more than 1,000 servers used by Rhadamanthys, VenomRAT and Elysium had been dismantled.
The repeated blows against StealC show the limits of these operations: seizing servers disrupts a criminal service, but does not necessarily shut it down if its operators remain free to rebuild their infrastructure.
What businesses should do now
The recovered data will be shared with several alert services so that victims can be notified: Have I Been Pwned, the French company Sekoia, the Shadowserver Foundation, as well as DIVD, CheckjeHack, NoMoreLeaks and the Dutch cybersecurity centre NL-NCSC, according to BleepingComputer. For a business, several steps are essential:
- check on Have I Been Pwned whether the domain’s business email addresses appear in these new leaks, and monitor alerts from your security provider;
- reset the passwords of flagged accounts and enable multi-factor authentication, starting with remote access and administrator accounts;
- for WordPress sites, change credentials, enable two-factor authentication and apply patches, as recommended by investigators;
- raise staff awareness of the risk posed by Zip files containing scripts downloaded from a search result.
A credential stolen by StealC can remain usable long after the initial infection. The presence of an account in this data should therefore be treated as a confirmed compromise, not as a mere alert.
Frequently asked questions
What is Gootloader?
A loader-type malware, active since at least 2020. It spreads through booby-trapped search results and a Zip archive containing JavaScript, then paves the way for other tools, sometimes ransomware.
How can I find out whether my credentials have been stolen?
The seized data is to be passed on, in particular, to Have I Been Pwned, where you can check an email address or monitor a domain. Sekoia and the Shadowserver Foundation are also among the recipients.
Has this malware disappeared?
Its known infrastructure has been seized, but no arrests have been announced. Previous Endgame waves show that some services, such as StealC, can reappear and require further action.
Sources
- Opération Endgame : la saison 4 commence avec Gootloader — LeMagIT, 2026-11-12
- Police dismantle Gootloader, CastleRAT, StealC malware infrastructure — BleepingComputer, 2026-11-12