Authorities seized 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC, disrupting malware delivery, remote control and credential theft in the same action.
Operation Endgame’s latest strike removed infrastructure behind three different criminal services: malware delivery, remote access and credential theft. Law enforcement and private partners actioned 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC.
The three malware families were separate targets, not one observed infection chain. Their roles still explain why this operation matters. Gootloader brought victims in. CastleRAT gave operators control of infected computers. StealC extracted passwords, stored access data and digital identities that could be sold or reused.
CodeAIntel assessment: hitting all three at once created friction at several points where one criminal crew can hand an infected machine, a foothold or stolen access to another.
Authorities reported action against 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC.
One action, three criminal capabilities
Operation Endgame says Gootloader used compromised websites and fake legal documents to infect victims. Dutch police add that its operators manipulated search results to draw people to criminal pages. A download could add the computer to a botnet and create an opening for later malware. The U.S. Justice Department says Gootloader infected at least 25,000 systems worldwide since 2018. It was used in ransomware attacks against at least 44 U.S. victims, causing approximately $28.8 million in losses.
CastleRAT served a different purpose. It gave attackers remote control of an infected computer. Operation Endgame says its use led to encrypted data, disabled IT systems and ransom demands.
StealC focused on the material inside the machine: passwords, stored access data and digital identities. Operation Endgame says that output could be traded or used for fraud.
The Justice Department says Gootloader infected at least 25,000 systems since 2018 and was used in ransomware attacks against at least 44 U.S. victims.
Cybercrime buys these capabilities by the piece
Operation Endgame describes the targets as cybercrime-as-a-service toolkits that enabled crimes including ransomware and data theft.
The operation did not say Gootloader, CastleRAT and StealC were used together against the same victims. CodeAIntel’s assessment is that the action matters because authorities targeted several capabilities at once instead of treating each malware family as an isolated technical problem.
Across the three targets, authorities removed delivery domains and server infrastructure, remediated 681 Gootloader-infected websites, and recovered victim data that can now support notifications.
The stolen data can lead victims back to infected machines
Authorities also secured more than 6.4 million stolen data items. Europol’s headline calls them victim datasets. Dutch police call them stolen personal data items. Operation Endgame refers to victim credentials. The number should not be read as 6.4 million unique people, current passwords or confirmed account takeovers. It is stolen material recovered from criminal infrastructure.
Dutch police say CastleRAT victim data is available through CheckYourHack and that victim data is also being shared with Have I Been Pwned, Shadowserver, DIVD, CheckjeHack, NoMoreLeaks and the Dutch NCSC. They say more personal data will be added in the coming weeks.
For some victims, one of those notices may be the first sign that a computer was infected. That is why the account named in an alert is only the beginning of the case. The more important question is which machine produced the stolen data and what else was exposed while the malware was present.
Dutch police said more than 6.4 million stolen personal data items were secured and that victim data would be shared through several notification and response organizations.
When the alert arrives, find the machine
A verified notice should lead responders back to the affected user, device and likely infection window. Clean or rebuild the machine, then invalidate the credentials and stored access data that may have left it. After that, review authentication and administrative activity for signs that somebody used the stolen access.
Because the notice comes from malware infrastructure, responders should treat the named account as a pointer to the affected host. If the source was an infected workstation, the same machine may also have exposed passwords, stored access data, wallets or system information. The response has to match the alert and the available evidence, but it starts with removing the source of the theft.
Dutch police said investigators kept monitoring new StealC versions after the June 2026 action before taking down 102 servers in the latest strike.
Investigators had to hit StealC again
StealC was also targeted in Operation Endgame’s June 2026 action. Dutch police say investigators continued monitoring new versions before taking down 102 servers in the latest strike. Five months between actions is a reminder that malware markets reorganize quickly.
This operation produced both disruption and leads. The servers and domains removed from service make current attacks harder. The recovered data gives victims a chance to find infections they may not know about.
Dutch police say more records will reach victim-notification services in the coming weeks. For defenders, the useful part is the notice that leads back to an infected machine—and closes the access it exposed.