Newshot Article Title: Europol Dismantles Infrastructure of Three Malware Families, Shuts Down 235 Servers and 257 Domains
Body:
Europol, together with international partners, dismantled the underground infrastructure associated with three malware families—Gootloader, CastleRAT, and StealC—focusing on the malware services that support ransomware attacks and data theft. On November 12, 2026, law enforcement announced the latest results of Operation Endgame: a total of 235 servers and 257 domains were taken down, and 6.4 million victim user data records were recovered from the criminal infrastructure.
The operation targeted the "cybercrime-as-a-service" model. Under this model, criminals provide attack tools or network access to other attackers to breach corporate networks. These services connect the entire attack chain, from initial infection to password theft, remote control, and ransomware deployment. Taking down their servers and domains can disrupt multiple links in the attack chain, rather than only striking the final ransomware payload.
Gootloader and CastleRAT Infrastructure Dismantled, Cutting Off the Upstream Attack Chain
Gootloader lures victims through fake legal documents hosted on compromised websites, including tampered WordPress sites. Law enforcement reported that the operation dismantled 14 servers and 218 domains associated with this malware and cleaned up 681 infected websites. Previous reports disclosed the technical principle of Gootloader's search poisoning: attackers forge forum pages and manipulate search result rankings to trick users into downloading malicious JavaScript files.
This delivery method turns ordinary online activities—such as users searching for contracts and business agreements—into entry points for attackers. After the malicious code executes, Gootloader drops additional attack tools onto the system. As a malicious loader, it is an important support for ransomware operators, who can use the access it obtains to prepare for follow-up attacks.
Researchers first discovered CastleRAT in 2025; the malware allows attackers to remotely control infected computers. The operation seized 120 servers and 39 domains associated with this malware. Previous technical analysis showed that CastleRAT has two versions, written in Python and C, and features keylogging, screen capture, and clipboard monitoring, helping attackers collect sensitive information and maintain persistent access.
StealC Data-Stealing Infrastructure Dismantled, Victim Data to Be Used for Risk Alerts
StealC mainly steals user passwords, saved login credentials, and digital identities; the stolen data is used for fraud and follow-up attacks. The operation dismantled 102 servers associated with this malware. Back in June 2026, Europol had already conducted an operation against StealC, along with SocGholish and Amadey malware at the same time, showing that law enforcement maintains sustained, high-pressure crackdowns on such criminal services.
It is worth noting that the total number of servers corresponding to the three malware families in this announcement is 236, one more than the announced total of 235. Law enforcement did not explain this discrepancy, and the reason for the data deviation remains unclear. The domain count, however, matches the announced total of 257 exactly. This discrepancy could affect outside assessments of the operation's actual scale.
The victim data recovered in this operation will be shared with platforms such as Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, Shadowserver, and NL-NCSC to send risk alerts to affected users. Europol's European Cybercrime Centre provided intelligence support, financial tracking, and victim notification services for the operation, while Eurojust coordinated judicial authorities across countries for the joint