Operation Endgame seizes 235 servers from Gootloader, CastleRAT, StealC

Europol and partners announced a fresh Operation Endgame phase on November 12, seizing infrastructure behind three malware families that feed ransomware crews their initial access: Gootloader, CastleRAT, and StealC. Across the action, authorities took down 235 servers and 257 domains and identified credentials belonging to 6.4 million victims, which will be shared through Have I Been Pwned, the Shadowserver Foundation, and the Dutch NCSC. If your organization touches any of these families' indicators, assume credential exposure and rotate now.

What was taken down

Per the official Operation Endgame announcement and reporting at CyberScoop:

• CastleRAT (remote access trojan): 120 servers and 39 domains seized.
• Gootloader (dropper / initial-access loader): 14 servers and 218 domains seized, plus 681 infected websites cleaned up.
• StealC (infostealer with dropper functions): 102 servers seized, building on earlier StealC takedowns in June 2026.

Europol framed the operation — about 30 public and private partners — as "the largest international effort against ransomware enablers." CyberScoop lists Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States taking part, coordinated by Europol and Eurojust. No arrests were announced.

What to do today

1. Check Have I Been Pwned for your domains once the 6.4M-credential set lands, and force resets on any hit.
2. Rotate credentials that could have passed through an infostealer: browser-saved passwords, session tokens, and VPN/RDP logins on any endpoint with a StealC or Gootloader detection in the last 12 months.
3. Hunt your history. A takedown removes infrastructure, not the data already exfiltrated. Review EDR and proxy logs for prior Gootloader SEO-poisoning redirects, CastleRAT C2, and StealC exfil.
4. Re-enroll MFA where session theft is plausible — stolen cookies survive password resets.

Context

Operation Endgame has run since 2024, moving through DanaBot, Bumblebee, Rhadamanthys, SmokeLoader, and — in June 2026 — SocGholish, Amadey, and StealC. Taking StealC again shows the pattern these actions keep running into: infrastructure comes back, and the StealC seller reportedly resurfaced in October 2026 with a successor tool. The value here is the victim-notification pipeline more than the seized boxes. The credentials are the asset ransomware affiliates buy; getting 6.4 million of them into Have I Been Pwned and national CERTs is the part that actually raises an attacker's cost. Treat the notification as a to-do list, not a headline.