Operation Endgame: Europol Seizes 235 Servers in 3-Malware Takedown

Operation Endgame has struck again. On 12 November 2026, Europol announced the latest phase of the international campaign, this time aimed at three malware families that help criminals break into networks and steal data: Gootloader, CastleRAT and StealC.

The headline numbers are big. Authorities say they took down 235 servers, seized 257 domains and secured 6.4 million victim datasets. For businesses across Europe, and anyone running a WordPress site, this one is worth reading closely.

What Happened in This Operation Endgame Phase

According to Cyberpress’s breakdown of the Europol announcement, nine countries took part: Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States. Europol’s European Cybercrime Centre supported intelligence work, financial tracing and victim notification, while Eurojust helped judicial authorities coordinate.

Here is how the takedown splits across the three malware families:

• Gootloader: 14 servers and 218 domains seized, plus 681 infected websites cleaned up.
• CastleRAT: 120 servers and 39 domains seized. This remote access trojan has been linked to ransomware incidents.
• StealC: 102 servers seized, extending earlier action against the same stealer in June 2026.

One small detail: the per-family server counts add up to 236, not 235. The difference has not been explained. It does not change the scale of the operation, but it is a reminder to read official figures carefully.

Why These Three Malware Families Matter

None of these tools is ransomware itself. That is exactly why they matter. They are the enablers, the first foothold that later turns into data theft or a full ransomware attack.

Gootloader is a loader that has long relied on compromised websites and search results to trick people into downloading malicious files. The fact that 681 infected sites had to be remediated tells you how it spreads: through ordinary business websites that were hacked and quietly turned into traps.

CastleRAT gives attackers remote control of an infected machine. Once inside, they can move around the network, steal credentials and prepare for bigger attacks.

StealC is an information stealer. It grabs saved passwords, browser cookies and other sensitive data, which then gets sold or used for account takeovers. Stolen session cookies are especially nasty because they can let attackers skip past passwords entirely.

How a Loader Infection Turns Into Ransomware

It helps to picture the full attack chain, because most companies only notice the last step.

It usually starts small. An employee searches for a contract template or an invoice format, lands on a legitimate-looking but hacked website, and downloads a file. That file is a loader. It does very little on its own, apart from checking the machine and pulling down the next piece of malware.

The next piece might be a remote access trojan like CastleRAT, which hands control to the attacker. Or it might be a stealer like StealC, which collects browser passwords and cookies within minutes. Those credentials often end up with initial access brokers, criminals who specialise in reselling footholds into company networks.

Days or weeks later, a ransomware crew buys that access, logs in with valid credentials, moves through the network and encrypts everything. By the time the ransom note appears, the original infection is long forgotten.

That is why disrupting loaders and stealers is such a smart strategy. Cut the supply of initial access, and you make every later stage harder and more expensive.

Why Small and Mid-Sized Firms Are Exposed

Large enterprises usually have a security operations team watching endpoints around the clock. Smaller companies often do not. They rely on antivirus, a shared admin password and a website a freelancer built years ago.

That is exactly the profile these malware families exploit. A neglected WordPress plugin becomes a Gootloader trap. A staff laptop with saved passwords becomes a StealC payday. Neither problem needs a huge budget to fix, but both need someone to own them.

Operation Endgame Keeps Building Pressure

This is not a one-off. Operation Endgame is a long-running campaign against the infrastructure behind ransomware, backed by more than 30 public and private partners. Back in June 2026, a separate phase hit SocGholish, Amadey and StealC. As ITPro reported at the time, that action disabled 326 servers, recovered 27 million compromised data sets and seized more than €41 million in criminal crypto assets.

So yeah, StealC has now been targeted twice in five months. That says two things. Law enforcement is keeping pressure on, and criminal operators keep rebuilding. Takedowns raise their costs and slow them down, but they do not end the threat.

You can follow official updates on the Operation Endgame news page.

What Happens to the 6.4 Million Victim Datasets

Victim data is being shared with notification partners including Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and the Dutch NCSC. If your email or organisation shows up in that data, you may get an alert through one of these services.

One honest caveat: 6.4 million datasets does not mean 6.4 million unique people. One person can appear in several records. Still, it is a large pool of exposed credentials, and a good moment to check your own.

What European Businesses Should Do This Week

Let me be direct. If your company runs a website, uses saved browser passwords or lets staff work from personal laptops, this takedown is relevant to you. Europol itself urged WordPress administrators to change credentials, turn on multifactor authentication and patch their systems.

Here is a practical checklist:

• Check exposure: Search company email domains on Have I Been Pwned and watch for notices from your national CERT.
• Reset and enforce MFA: Rotate passwords for admin, email and cloud accounts, and require phishing-resistant MFA where possible.
• Kill old sessions: Revoke active sessions and tokens, since stealers like StealC grab cookies that can bypass passwords.
• Audit your website: Update WordPress core, themes and plugins, remove unknown admin accounts and scan for injected code.
• Watch endpoints: Make sure EDR tools are running and alerting on unusual remote access and credential dumping.

Under GDPR and NIS2, many organisations also have reporting duties if a breach exposes personal data or affects essential services. If you find signs of compromise, involve your legal and compliance team early rather than late.

Key Takeaways

• Big disruption: The 12 November Operation Endgame phase hit Gootloader, CastleRAT and StealC, with 235 servers and 257 domains taken down.
• Global effort: Nine countries took part, supported by Europol’s EC3 and Eurojust.
• Exposed data: 6.4 million victim datasets were secured and are being shared with notification services.
• Repeat target: StealC was also hit in June, which shows criminal infrastructure keeps coming back.
• Action needed: Reset credentials, enforce MFA, revoke sessions and patch WordPress sites now.

How TecniForge Can Help

At TecniForge, we help businesses navigate these technology shifts. Whether you need custom software development, AI integration, or cloud migration, our team builds scalable solutions. We also help companies harden their websites, lock down cloud and email accounts, and set up monitoring that catches loaders and stealers before they turn into ransomware. Talk to our experts.

When did your team last check whether company credentials are already sitting in a stolen dataset?