Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins

An international police operation successfully dismantled servers behind Gootloader, CastleRAT and StealC malware this week. Authorities seized approximately 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany's Federal Criminal Police Office (BKA).

Gootloader Malware

Gootloader, a loader malware that downloads other malicious software including ransomware, has infected at least 25,000 computers worldwide since 2018. The U.S. Justice Department reported it was used in ransomware attacks against 44 American victims, causing about $28.8 million in losses. German police provided a higher count, suggesting millions of infections since its emergence in 2020.

The malware spread through fake legal documents on hacked websites, often WordPress sites, using SEO poisoning to boost their search rankings. Police took down 14 servers and 218 domains associated with Gootloader and removed malware from 681 hacked websites.

CastleRAT and StealC

CastleRAT, a remote access trojan (RAT) known since 2025, allows attackers to control infected computers remotely. Police seized 120 of its servers and 39 domains. StealC, an infostealer that exfiltrates passwords and credentials, had its servers taken down again after operators brought it back online following a June operation.

Some of StealC's key infrastructure ran on Virtualine/Omegatech, a bulletproof hosting service that advertised to criminals. Police shut down this hosting service in a late-October takedown. Across all three tools, authorities seized 235 servers and 257 domains.

Victim Response

Dutch police have loaded CastleRAT data into 'Check your hack,' where users can enter an email to see if their information was compromised. The service sends instructions for malware removal if an address is found in the data. More information will be added in coming weeks.

Organizations can join 'No More Leaks,' a police project sharing data with private partners. Stolen information is also being shared with services including Have I Been Pwned and the Shadowserver Foundation. Police warn that criminals may still possess stolen logins and advise victims to change passwords even after the takedown.