Operation Endgame seizes 6.4 million stolen logins from Gootloader and StealC

An international law enforcement coalition executed Operation Endgame this week, dismantling the infrastructure behind three major malware families: Gootloader, CastleRAT, and StealC. The operation resulted in the seizure of approximately 6.4 million stolen login credentials belonging to more than 40,000 victims, alongside the takedown of hundreds of servers and domains used to distribute these threats.

What happened

The coordinated action targeted the backend systems that allow criminals to infect computers, steal data, and deploy ransomware. According to Germany's Federal Criminal Police Office (BKA), authorities seized 235 servers and 257 domains across the three malware operations. Europol supported the campaign, which focused on disrupting the tools attackers use to gain initial access to victim networks.

Gootloader, a malware loader that has infected millions of computers since 2020, was a primary target. It spreads by placing fake legal documents on compromised websites, often WordPress installations, using search engine optimization poisoning to rank these pages highly. Once a user downloads the document, the loader installs additional malware, frequently ransomware. In the United States alone, Gootloader facilitated ransomware attacks against at least 44 victims, causing roughly $28.8 million in losses. During this operation, police removed malware from 681 hacked websites and took down 14 servers and 218 domains associated with the group.

The operation also struck at CastleRAT, a remote access trojan identified in 2025, and StealC, an infostealer designed to exfiltrate passwords. Authorities seized 120 servers and 39 domains linked to CastleRAT. StealC’s infrastructure was hit again after a previous disruption in June; its operators had rebuilt their network using bulletproof hosting services like Virtualine/Omegatech, which were themselves taken down in late October. No arrests were announced as part of this specific weekly action, though Dutch police are continuing investigations into Gootloader’s main suspect.

Key details

• Scale of theft: Approximately 6.4 million stolen logins from over 40,000 victims were seized by authorities.
• Infrastructure removed: Police took down 235 servers and 257 domains across Gootloader, CastleRAT, and StealC operations.
• WordPress impact: Malware was removed from 681 hacked websites, many of which were WordPress sites used to host fake legal documents for SEO poisoning.
• Financial damage: In the U.S., Gootloader-linked ransomware attacks caused an estimated $28.8 million in losses across 44 known victims.
• Recidivism: StealC operators rebuilt their infrastructure after a June takedown, relying on criminal-friendly hosting providers before this latest disruption.
• Victim notification: Stolen data is being shared with services like Have I Been Pwned and the Shadowserver Foundation to help identify compromised accounts.

Background

Gootloader operates as a "loader," meaning its primary function is to establish a foothold on a victim's computer and then download other malicious payloads. It relies heavily on "SEO poisoning," a technique where attackers create web pages with popular search terms so they appear at the top of search results. Users looking for legitimate legal forms or software updates inadvertently download the malware instead.

CastleRAT is a Remote Access Trojan (RAT), which gives attackers full control over an infected machine, allowing them to move laterally through a network. StealC is an "infostealer," specifically designed to scrape browsers and system files for saved passwords, cookies, and session tokens. These tools are often sold or leased on cybercrime forums, allowing less technical criminals to launch sophisticated attacks.

Why it matters

For teams that self-host software, particularly WordPress sites, this operation highlights the persistent risk of supply chain and platform compromise. The 681 cleaned websites demonstrate that even reputable platforms can be weaponized if administrators do not maintain strict security hygiene. Attackers often gain entry through stolen credentials or unpatched plugins, then install backdoors that persist even if the initial vulnerability is fixed. This means that simply updating software may not be enough if a hidden access point remains.

The seizure of 6.4 million logins underscores the value of credential reuse in modern attacks. If your organization uses passwords that have appeared in previous breaches, you are at higher risk of being targeted by loaders like Gootloader or stealers like StealC. Furthermore, the fact that StealC operators quickly rebuilt their infrastructure after a June takedown shows that these threats are resilient. Relying solely on external law enforcement actions is not a viable security strategy; internal defenses must assume that malware infrastructure will always re-emerge.

What you can do

• Audit administrator accounts: Remove any unrecognized user accounts from your WordPress or self-hosted applications immediately.
• Enforce strong authentication: Change all admin passwords to unique, complex strings of at least 12 characters and enable multi-factor authentication (MFA) wherever possible.
• Restrict admin access: Configure your web server to allow access to the /wp-admin or equivalent login pages only from known, trusted IP addresses.
• Scan for backdoors: Do not just update plugins; actively scan your codebase for unknown files or modified core files that may serve as persistent backdoors.
• Check for compromise: Use services like "Check your hack" or Have I Been Pwned to see if your organization’s email addresses appear in the seized StealC or CastleRAT data dumps.
• Update everything: Ensure your WordPress core, themes, and plugins are updated to the latest versions to close known vulnerabilities that loaders exploit.