International police operation seizes hundreds of servers used by three major malware networks

Europol and law enforcement authorities across nine nations have seized 235 servers and 257 domains tied to the Gootloader, CastleRAT, and StealC malware networks. Coordinated alongside Eurojust and private partners, the action also recovered 6.4 million victim credentials and datasets stored on the compromised systems. Participating agencies spanned Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States. [1][2]

The targeted malware families include Gootloader, a loader running since 2020; CastleRAT, a remote access trojan that emerged last year; and StealC, an information stealer designed to extract sensitive data and cryptocurrency wallets. Europol stated that suspects stole and sold these credentials to fuel secondary attacks, including ransomware deployments. The seized information is being shared with alerting platforms such as HaveIBeenPwned, DIVD, and The Shadowserver Foundation, while authorities urge WordPress administrators to reset credentials, turn on multi-factor authentication, and apply security patches. [2]

The sweep is the latest phase of Operation Endgame, a recurring international initiative aimed at dismantling cybercrime-as-a-service infrastructure. Previous actions under the initiative have seized servers linked to groups such as Evil Corp and dismantled infrastructure supporting botnets like SocGholish, Rhadamanthys, and Smokeloader. [1][2]