Source-reported · Independent verification status is not recorded for this article; claims remain attributed to their sources.
Operation Endgame Seizes Servers and Millions of Logins in Major Malware Crackdown
An international police operation has seized 235 servers, 257 domains and 6.4 million stolen logins tied to Gootloader, CastleRAT and StealC malware campaigns that affected more than 40,000 victims.
Police agencies working together across borders have hit a key layer of infrastructure that kept several major malware operations running.
In an operation called Endgame, investigators say they disrupted systems used to distribute and control Gootloader, CastleRAT and StealC. They seized 235 servers and 257 domains, and recovered 6.4 million stolen login credentials linked to more than 40,000 known victims, according to the reporting.
Each seized server had acted as a hub for infections, data theft or extortion. The hijacked domains helped criminals disguise malicious downloads or lure people onto fake sites where their passwords could be harvested. The stolen logins include personal accounts and access credentials for corporate systems and cloud services.
For ordinary users, these tools often show up as drained accounts, locked files or strange logins into email and social media. For corporate security teams, Gootloader, CastleRAT and StealC are familiar names. Gootloader is associated with stealthy initial compromise through booby-trapped documents and search results, while CastleRAT and StealC give attackers remote access and a way to quietly move through networks and siphon data.
Operation Endgame goes after the backbone of those campaigns. By taking over command-and-control servers and the domains pointing to them, police can cut off infected machines from their controllers and block further instructions or data exfiltration. The public reporting doesn’t say whether authorities will use the seized infrastructure to warn or help clean up victim systems.
The scale of the action highlights the importance of coordination in cybercrime cases. Criminal operators spread their hosting, domains and victims across many jurisdictions, so no single country sees the entire picture. Endgame shows that when agencies share intelligence and move at the same time, they can disrupt sprawling operations that would be difficult to tackle alone.
For the groups behind these malware families, the seizures mean higher costs and uncertainty. They’ll need new servers, new domains and, in many cases, a fresh pool of victims. Some affiliates may abandon the schemes if they see infrastructure disappearing and arrests following.
But the incentives that fuel such operations remain. As long as millions of stolen logins can be monetized and organizations run unpatched or poorly protected systems, replacement campaigns will appear. The seized infrastructure supported attacks that compromised tens of thousands of victims before investigators could move.
Key signals to watch now include whether law enforcement announces arrests tied to the seized servers, whether targeted organizations receive coordinated remediation guidance, and whether security firms observe a drop in Gootloader-style activity in the coming months.