Actively exploited Security news
Operation Endgame takes down Gootloader, CastleRAT and StealC servers, recovers 6.4 million victim records
On 12 November 2026 Europol announced the latest Operation Endgame strike. Police and private-sector partners actioned 235 servers and 257 domains used by the Gootloader, CastleRAT and StealC malware and found more than 6 million stolen credentials in the seized infrastructure. The data is going to services that notify victims. Here is what the three malware families do, how to check whether you are a victim, and what WordPress site owners should do.
Key points
- Europol announced action against three malware families on 12 Nov 2026: Gootloader (14 servers and 218 domains taken down, 681 infected websites remediated), CastleRAT (120 servers and 39 domains seized) and StealC (102 servers dismantled, following a June 2026 action).
- In total 235 servers and 257 domains. Europol says more than 6 million victim credentials were identified in the seized infrastructure; the headline puts it at 6.4 million victim datasets.
- Victim data is being shared with notification services: Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC.
- The US Justice Department added on 12 Nov that Gootloader has infected at least 25,000 computers since 2018 and led to ransomware attacks on at least 44 US victims with about $28.8 million in losses. Neither Europol nor DOJ announced arrests or charges.
What happened
Europol on 12 November 2026 announced another strike in the international Operation Endgame against malware infrastructure. This time law enforcement and private partners went after three malware families:
| Malware | What it does (per Europol) | Action |
|---|---|---|
| Gootloader | spreads malware through fake legal documents on compromised sites, often WordPress | 14 servers and 218 domains taken down, 681 infected websites remediated |
| CastleRAT | remote access trojan known since 2025 | 120 servers and 39 domains seized, victim data shared for alerts |
| StealC | steals passwords, stored credentials and digital identities | 102 servers dismantled, continuing a June 2026 action |
Europol puts the total at 235 servers and 257 domains. (The per-family server counts add up to 236 - the discrepancy is in the announcement itself.) Police found more than 6 million victim credentials in the seized infrastructure; the headline speaks of 6.4 million victim datasets. According to Europol the suspects were using these credentials, which were seized "this week".
Europol's announcement does not name participating countries and reports no arrests or named suspects.
The US Department of Justice published its own Gootloader announcement the same day. Under court authorization, US agencies and partners removed Gootloader from more than 100 servers (including compromised WordPress sites) and seized US domains used to deliver and control the malware. According to DOJ, Gootloader has infected at least 25,000 computers worldwide since 2018. Infected machines joined a botnet that the operators used to spread further and to sell access to ransomware actors - leading to attacks on at least 44 US victims and roughly $28.8 million in losses. The case is prosecuted in the District of Colorado, and the warrants were unsealed this week. Partners included Germany's BKA, the Dutch National Police, the UK's NCA, the RCMP, the AFP, Danish and Paris police, and Europol. DOJ did not name any defendants either.
How the attacks worked
Who is affected
- People with infected computers - their passwords, stored credentials and sessions may be among the 6 million seized records.
- Website owners, especially on WordPress - Gootloader abused compromised sites for distribution. Europol reports 681 remediated sites; if anyone has told you your site serves odd "contract templates", take it seriously.
- Businesses - stolen employee credentials are a common way into corporate systems.
How to spot compromise
Europol has not published technical indicators (hashes, domains) for this action. What you can do:
- Enter your email at Have I Been Pwned - Europol says the service received victim data. As of the evening of 12 Nov it was not yet listed, so check again in a few days or set up notifications.
- Network operators: Europol says The Shadowserver Foundation also received data. Shadowserver sends free reports to network owners - sign up if you don't already.
- On WordPress, look for unknown administrators, pages and files you did not create, and unfamiliar plugins. You can compare suspicious files against a backup by fingerprint using our hash calculator.
What to do
- If Have I Been Pwned or another service alerts you, treat the computer as compromised: scan it, ideally reinstall it. Change passwords from another, clean device - email, bank and password manager first.
- Sign out of all sessions and enable MFA. Europol says StealC steals digital identities - typically logged-in sessions - so a password change alone may not lock the attacker out. Step-by-step guidance is in Hacked account: what to do and Data breach: email or password leaked.
- WordPress admins: Europol urges users to update credentials, enable multi-factor authentication and patch vulnerabilities. Update core, plugins and themes and remove anything unused.
- Don't download "contract templates" from unknown sites. Get legal documents from trusted sources (government, bar associations, your lawyer). You can check an unfamiliar link first with our link checker.
Timeline
Updates
- 13 Nov 2026 - added the US Justice Department announcement (12 Nov): Gootloader was removed from more than 100 servers under court authorization and US domains were seized. Since 2018 it infected at least 25,000 computers worldwide, and its operators sold access to ransomware gangs - at least 44 US victims and about $28.8 million in losses. The case is handled in the District of Colorado; DOJ named no defendants.
- 12 Nov 2026 - first version of this article.
FAQ
How do I find out whether my data was seized?
Europol says victim data has been shared with Have I Been Pwned, among others. Enter your email there or sign up for free notifications. As of the evening of 12 Nov 2026 the data from this operation was not yet listed - such datasets usually appear with some delay, so check again in a few days. Network operators subscribed to Shadowserver's free reports should watch those as well.
What is Gootloader and why does it involve WordPress?
According to Europol, Gootloader spread fake legal documents through compromised websites, often WordPress sites. Someone searching for a contract template would land on a legitimate-looking site and download malware instead. Europol says 681 infected sites were remediated.
Is changing my password enough?
Only if the computer is clean. CastleRAT is a remote access trojan and StealC steals passwords, stored credentials and digital identities straight from the machine. If you were infected, clean or reinstall the computer first and change passwords from another, clean device. Then sign out all sessions and enable MFA.
Is this the end of these malware families?
Not necessarily. The action took infrastructure offline and recovered data, but the announcement reports no arrests. Operators can rebuild - StealC is already being targeted for the second time in six months.
Sources
- U.S. Department of Justice - Gootloader Malware Disrupted in International Cyber Operation (12 Nov 2026)
- Europol - 6.4 million victim datasets secured in international operation against malware networks (12 Nov 2026)
- Operation Endgame - official operation website with the 12 Nov 2026 announcement
- Europol - Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks (June 2026)
- Have I Been Pwned - check whether your email was exposed
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
SilentAir: a state-level actor reroutes calls and SMS through hijacked mobile operators, mainly targeting Taiwan
Mobile network security vendor Enea published research on 11 November 2026 into a threat actor it calls SilentAir. According to Enea, the group controls network elements inside operators in at least six Asian countries and injects signalling into the international interconnect that diverts selected people's calls and text messages to itself. Some victims received two-factor authentication codes right after interception. Here is what is confirmed, and what it means for operators and for everyday users.
Actively exploited
Apify breach: attacker used a compromised credential to obtain user account credentials
Web scraping and automation platform Apify detected on 11 November 2026 that an unauthorized third party had used a compromised credential on 9 and 10 November to obtain a number of account credentials and access related Apify accounts. The company closed the access path, revoked some OAuth connections including GitHub, and rotated internal secrets. Here is what is confirmed and what users need to do.
Actively exploited
Cairn: CL-STA-1238 let autonomous AI agents attack chipmakers, defense firms and nonprofits
On 12 November 2026 Unit 42 (Palo Alto Networks) published an analysis of a campaign in which a China-nexus actor used a customized fork of the open-source Cairn framework. In August and September 2026 its AI agents ran 25 operations against at least 19 organizations largely on their own, from reconnaissance to persistence. Nothing about it was novel: weak passwords, open registration endpoints and old bugs. Here is what is confirmed, the indicators, and what it means for defenders.