Police seize servers of three malware networks and find over 6 million stolen logins

Police in nine countries, coordinated by Europol, have taken down the servers behind three malware families: the Gootloader loader, the CastleRAT remote access trojan and the StealC password stealer. According to Europol's 12 November announcement, 235 servers and 257 domains were seized or shut down together with private partners. On those servers investigators found more than 6 million logins stolen from infected computers. The headline of the release gives 6.4 million victim datasets.

Gootloader has been active since 2020. Its operators hacked websites, often running WordPress, and planted fake legal documents on them. People who downloaded such a file infected their computer, and Gootloader then pulled in other malware, including ransomware. Police took down 218 Gootloader domains and cleaned up 681 infected websites.

CastleRAT appeared in 2025 and lets an attacker control an infected computer remotely. Europol says it was built to be hard to detect and was used in attacks that encrypted data, crippled whole IT systems and forced companies to pay ransoms. Police seized 120 CastleRAT servers and 39 domains. StealC pulled saved passwords, logins and digital identities from infected computers, and the stolen data was then sold. Police shut down 102 StealC servers. In June 2026 the same operation had already hit StealC together with Amadey and SocGholish, but the stealer kept running.

Read the full article on vpnlab.io: https://vpnlab.io/en/europol-endgame-gootloader-castlerat-stealc-takedown-3353