CastleRAT, StealC, Gootloader: BleepingComputer reports Europol takedown

What happened

BleepingComputer reports that Europol and law enforcement partners from nine countries seized hundreds of servers and domains used by the Gootloader, CastleRAT and StealC malware operations. The outlet published the story on November 12, 2026 BleepingComputer. This advisory rests on that single outlet. The details below are what BleepingComputer says, partly quoting Europol.

According to BleepingComputer:

• The action is part of Operation Endgame, coordinated by Europol and Eurojust. Agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States took part.
• Together with private partners, the authorities seized 257 domains and 235 servers.
• Authorities identified 6.4 million victim datasets on the targeted infrastructure. The outlet says these were stolen from malware-infected systems for use in other cyberattacks, including ransomware breaches.
• BleepingComputer describes Gootloader as a malware loader active since 2020, StealC as an infostealer that exfiltrates credentials, cryptocurrency wallets and other sensitive information, and CastleRAT as a remote access trojan that surfaced last year. It says all three have been used by various cybercriminal operations, including ransomware gangs.
• BleepingComputer quotes Europol as saying that over 6 million victim credentials were identified in the seized criminal infrastructure, and that the suspects were using them to sell and later use in other attacks such as ransomware.

Not confirmed in the source: the names of any suspects, any arrests, how many individual users or organisations are affected, and whether the credential data has been independently verified. The article does not describe the infection method for CastleRAT. No CVE is cited.

Am I affected?

The source does not say who is affected beyond the victims of infected systems whose data sat on the seized infrastructure. Whether you are one of them is not confirmed for any individual.

BleepingComputer quotes Europol as saying victim data will be made available through HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC. Per the same quote, the aim is to alert victims of credentials stolen by the CastleRAT malware. The article does not say when each platform will publish this data.

Europol also urges WordPress users to update credentials, enable multi-factor authentication and patch vulnerabilities, according to the same BleepingComputer quote.

What to do now

1. Check your email addresses and domains on the platforms Europol names, as relayed by BleepingComputer, such as HaveIBeenPwned. The article does not say when each platform will publish the data.
2. If you find a match, change the exposed passwords and enable multi-factor authentication, as Europol urges according to BleepingComputer.
3. If you run WordPress, update credentials, enable multi-factor authentication and patch known vulnerabilities, as Europol urges per the same report.
4. Check the original article for updates, since this advisory relies on one outlet and details may change BleepingComputer.

Update, 12 November 2026

The420.in, which attributes the figures to Europol, gives a per-malware breakdown that BleepingComputer’s account did not include (The420.in):

• Gootloader: 14 servers and 218 domains taken down, and 681 compromised websites remediated. The outlet says it spread through hacked WordPress sites using fake legal documents.
• CastleRAT: 120 servers and 39 domains seized.
• StealC: 102 servers dismantled, continuing earlier action against it in June 2026.

The420.in also says the discovery of the credentials does not necessarily mean every affected account was misused. This remains a single-outlet report, and the figures are not independently verified here.

Sources

• BleepingComputer: Police dismantle Gootloader, CastleRAT, StealC malware infrastructure