Malware News 6.4 million victim datasets secured in international operation against malware networks

[Shadowra]

Content source

https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks

Europol, alongside global partners, has dismantled the criminal infrastructure behind Gootloader, CastleRAT, and StealC malware. In coordinated actions, law enforcement seized 235 servers and 257 domains, severely crippling these malware distribution networks.

The operation targeted "cybercrime-as-a-service" models, where these tools enabled further crimes like ransomware attacks and data theft. During the action, 235 servers and 257 domains were actioned by law enforcement together with private parties.

The participating law enforcement and private partners took action against three malicious toolkits:

• Gootloader malware, a so-called dropper/loader, enabled unauthorised access to computer systems by distributing fake legal documents through compromised websites. Victims who downloaded these documents became infected, often via hacked WordPress sites. This widespread approach led to further criminal activities, including ransomware installation for digital extortion. 14 servers and 218 domains were taken down; 681 infected websites remediated.
• CastleRAT is a remote access trojan (RAT) known since 2025. Such malware enables attackers to control an infected computer from a distance and to misuse it for criminal purposes. CastleRAT featured a modern technical architecture, could be deployed flexibly, and employed mechanisms that made its detection difficult. The use of CastleRAT resulted in the encryption of numerous data sets, the crippling of whole IT systems, and forced affected companies and organisations to pay ransom. 120 servers and 39 domains were seized, with victim data shared for alerts.
• The malware StealC (a so-called stealer with dropper function) was spread through multiple attack vectors. It was primarily designed to extract sensitive information such as passwords, stored access data and digital identities from compromised computers and to make them available for subsequent illicit use, especially data trading and fraudulent use. 102 servers were dismantled, continuing efforts from June 2026.

6.4 million victim credentials identified​

During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week. The suspects were using these credentials, stolen from the victims after they infected them, to sell them and later be used for other cyber-attacks such as ransomware.

Victim data will be made available via platforms HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC, alerting victims of stolen credentials caused by the CastleRAT malware. WordPress users are urged to update credentials, enable multi-factor authentication, and patch vulnerabilities.

Source : 6.4 million victim datasets secured in international operation against malware networks – Gootloader, CastleRAT, and StealC malware targeted in latest Operation ENDGAME cyber strike | Europol

 

[Bot]

Source : 6.4 million victim datasets secured in international operation against malware networks – Gootloader, CastleRAT, and StealC malware targeted in latest Operation ENDGAME cyber strike | Europol

Hi Shadowra, this is a significant disruption because these are upstream enablers: loaders, stealers and RATs that provide the initial access used for ransomware and account takeover. Knocking out that infrastructure can interrupt many later attacks at once. However, “dismantled” should be read as disrupted, not eradicated—existing malware copies, operators and previously sold credential logs do not disappear when servers are seized.

A couple of important details:

• The 6.4 million figure refers to recovered records/credentials, not necessarily 6.4 million unique victims. One infected device can yield credentials for numerous services.
• The listed server figures total 236—14 for GootLoader, 120 for CastleRAT and 102 for StealC—whereas the headline figure is 235. Europol’s release does not explain whether there is overlap or simply an accounting error.
• Notification data may not appear immediately. The Dutch police say more records will be added over the coming weeks, so a clean lookup today is not an all-clear.

Anyone receiving a notification linked to an infostealer should change affected and reused passwords from a trusted device, revoke existing sessions and app passwords, check recovery details and mailbox forwarding rules, and enable MFA—preferably passkeys or security keys. Primary email, password-manager, financial, cloud and hosting accounts deserve priority.

Crucially, changing passwords on the possibly infected computer can simply hand the replacements to the stealer. If execution or infection is suspected, disconnect that machine from sensitive accounts and open a case through Get help; a clean scanner result alone would not establish that the system is clean.

For compromised WordPress sites, password rotation is only part of the job. Patch core, themes and plugins, remove abandoned components, inspect administrator accounts and modified files, and rotate hosting/SFTP and other relevant secrets after the site itself has been cleaned. Otherwise the backdoor may remain—rather an inconvenient detail for the reassuring “password changed successfully” screen.

Sources

• 6.4 million victim datasets secured in international operation against malware networks - Gootloader, CastleRAT, and StealC malware targeted in latest Operation
• Internationale actie maakt netwerken van cybercriminelen onschadelijk | politie.nl