It started with a document that looked completely ordinary. A legal notice, sitting on a website you had no reason to distrust. One click, and the trap snapped shut. That is how Gootloader worked for years, and it is why police across nine countries spent this week pulling its plugs.
On November 12, Europol announced the latest action in Operation Endgame, its long-running campaign against the tools that power ransomware. This time the targets were three malware networks: Gootloader, CastleRAT and StealC. Investigators seized or disrupted 235 servers and 257 domains, and recovered more than 6.4 million sets of stolen victim data.
The operation was coordinated by Europol and Eurojust, with law enforcement from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States. More than 30 public and private partners supported the effort, according to Europol.
What Europol Operation Endgame seized this week
The headline numbers tell only part of the story. Behind the 235 servers and 257 domains sit three very different criminal tools, each playing its own role in the same supply chain. One delivered the malware. One gave attackers remote control. One stole the passwords.
That division of labour is exactly what Operation Endgame is designed to break. Rather than chasing individual hackers, investigators target the shared infrastructure that many criminal groups rely on. Take away the tools, and dozens of separate attacks lose their starting point.
Europol’s own breakdown of the seizures adds up to 236 servers, one more than the headline total of 235, a small discrepancy the agency has not explained. The gap hardly matters to the victims. What matters is that three networks that fed ransomware gangs are now offline.
Gootloader: the fake legal documents trap
Gootloader was the delivery man of the trio. It spread through compromised websites, many of them hacked WordPress installations, where visitors were offered what appeared to be legal documents. The files looked legitimate. They were not.
Once a victim opened one, Gootloader quietly installed itself and opened the door for whatever came next, often ransomware. According to the US Department of Justice, the malware infected at least 25,000 computers and caused roughly $28.8 million in losses since 2018.
Investigators took down 14 servers and 218 domains linked to Gootloader, and cleaned up 681 infected websites. That last number matters more than it sounds. Every remediated website is one fewer trap waiting for the next unsuspecting visitor.
CastleRAT: remote control for ransomware gangs
If Gootloader opened the door, CastleRAT handed over the keys. The remote access trojan, known since 2025, let attackers take control of infected computers from afar, moving through networks, stealing files and preparing the ground for ransomware.
Europol linked CastleRAT infections to ransomware incidents that encrypted data, wrecked IT systems and ended in ransom demands. Authorities seized 120 servers and 39 domains connected to the trojan, and shared victim information so affected organisations could be warned.
Remote access tools like this one are the quiet middle step in many headline-grabbing attacks. The victim rarely knows they are there. The damage only becomes visible weeks later, when files are locked and a ransom note appears.
StealC: the credential thief
The third network, StealC, did the simplest job and one of the most damaging. It is an information stealer with dropper functionality, built to harvest passwords, stored login credentials and digital identities from infected machines, then sell them on to other criminals.
Investigators dismantled 102 servers tied to StealC, extending enforcement work that began in June 2026. Stolen credentials are the raw material of the cybercrime economy. They fuel account takeovers, fraud and the initial access that ransomware gangs buy from brokers.
The 6.4 million victim datasets recovered across the operation are mostly these stolen credentials. That figure does not necessarily mean 6.4 million different people were affected, since one person can appear in several datasets, but the scale of the haul is still striking.
Nine countries, one operation
Operation Endgame works because cybercrime does not respect borders, and neither does the response. Europol’s European Cybercrime Centre provided intelligence analysis, financial tracing and victim notifications, while Eurojust handled the judicial cooperation between countries.
The nine participating countries each took action on their own soil at the same time. That coordination is the point. A server seized in one country means little if the same network simply moves to another. A simultaneous strike leaves it nowhere to go.
This is not the first Endgame action, and Europol does not pretend it will be the last. Earlier phases targeted other malware families, and a June 2026 action already hit StealC once. Each round removes a layer of the infrastructure that ransomware depends on.
What happens to the 6.4 million stolen records
Recovering stolen data is only useful if it reaches the people it was taken from. Europol said victim information will be shared with notification and cybersecurity organisations, including Have I Been Pwned, the Shadowserver Foundation and the Dutch National Cyber Security Centre.
That means some victims will learn their passwords were stolen only now, months or years after the infection. It is an uncomfortable message to receive, but it is far better than finding out when an account is emptied or a company network is breached.
Anyone who suspects their credentials were caught up in one of these networks should change affected passwords and turn on two-factor authentication. The advice is familiar because it works, and because stolen passwords remain usable long after the servers that collected them are gone.
Why this takedown matters, and its limits
Operation Endgame is the largest international effort against the enablers of ransomware, and this week’s action shows why that strategy matters. Gootloader, CastleRAT and StealC were not household names, but they were the plumbing beneath countless attacks.
At the same time, Europol is careful about what it claims. The announcement describes disruption, not elimination. No arrests were reported in this phase, and the operators behind the networks may try to rebuild. Malware infrastructure is cheap to replace, even when the takedown is thorough.
The context here is a year of heavy losses for the cybercrime economy. Earlier in November, researchers documented the N-able N-central zero-day saga, where attackers exploited freshly published flaws within hours.
Weeks earlier, the Fireworks AI breach exposed customer datasets and model weights, and the Railway breach showed stolen AI keys racking up $740,000 in fraudulent charges.
Against that backdrop, a coordinated takedown that removes three tools at once is a genuine win. It will not end ransomware, and Europol does not claim it will.
But every server seized and every website cleaned is one fewer opening for the next attack, and 6.4 million stolen records are now in the hands of the people trying to protect their owners, not the criminals who stole them.
For the rest of us, the lesson is the same one Gootloader’s victims learned too late: a document that looks official is not proof that it is safe. Check the source before you click, keep your software updated, and treat every unexpected attachment as a question, not an instruction.
That caution, multiplied across millions of users, is the defence no takedown can replace.
