Police dismantle Gootloader, CastleRAT and StealC malware infrastructure across nine countries
Millions of stolen logins were seized, and affected people and site owners are being urged to check exposure and secure their accounts.
Law enforcement from nine countries, coordinated by Europol and Eurojust under Operation Endgame, dismantled infrastructure for the Gootloader loader, the CastleRAT remote access trojan and the StealC infostealer, seizing 235 servers and 257 domains. Gootloader, used since 2018 or 2020 depending on the source, spread through fake legal documents on compromised WordPress sites and was tied to ransomware attacks that the US Justice Department says caused about $28.8 million in losses. Investigators also seized roughly 6.4 million stolen logins, which the suspects had been selling for use in later attacks including ransomware. Victim data is being shared with services such as Have I Been Pwned and No More Leaks so affected people and organisations can be notified. Site owners are advised to reset administrator passwords, enable multi-factor authentication, remove unknown accounts and backdoor code, and update WordPress and its plugins. No arrests were announced in this action.
Why it matters
The takedown removes infrastructure that delivered ransomware and sold stolen credentials, lowering the supply of access that criminals could use in later attacks. For ordinary users, the practical consequence is that their email address may appear in the seized data and can be checked through Check your hack. For WordPress site owners, the seizure is a reminder that compromised sites were the main entry point for Gootloader, so hardened accounts matter for the wider web. No arrests were announced, so the operations are disrupted rather than closed off.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.