Operation Endgame, round four: Gootloader, CastleRAT and StealC taken down – and what remains on your side

Some weeks the news from law enforcement is better than the news from research. From 9 to 11 November 2026, police agencies from nine countries – among them Germany’s Federal Criminal Police Office (BKA) and the Frankfurt prosecutor’s cybercrime unit ZIT – coordinated by Europol and Eurojust took the infrastructure of three malware families offline. The tally Europol published on 12 November: 235 servers and 257 domains seized or taken down, 6.4 million victim datasets secured, 681 compromised websites cleaned.

It is the fourth major action week of Operation Endgame since May 2024 and the second this year. The approach has stayed the same: instead of chasing ransomware groups one by one, the authorities target the service providers nearly all groups depend on – the loaders, droppers and stealers that obtain and sell the first access to a network.

Three families, three roles.

Figures from the US case give an idea of the damage: according to the Department of Justice, Gootloader has been used in at least 44 ransomware attacks since 2018, with costs of around 29 million US dollars. Dutch police ran parallel investigations against the alleged main operator behind Gootloader.

Why Gootloader hits the Mittelstand in particular.

Gootloader’s distribution method is tailored to companies, not private individuals. Anyone searching for “NDA template” or “service agreement sample” finds on the first results page a seemingly reputable site – often the hacked website of a real business – with a forum post offering exactly that document for download. The ZIP contains a JavaScript file that installs the loader when opened. The person doing so typically sits in accounting, purchasing or management – and has a machine with access to precisely what a ransomware affiliate needs.

That also explains the 681 cleaned websites: Gootloader lives off other people’s WordPress installations that nobody updates. Anyone running a website may not have been a victim in this chain but an involuntary distributor.

What a takedown achieves – and what it does not.

Seized servers and domains interrupt command and control. Infected machines stay infected; they merely can no longer reach their controllers. For Germany, the BSI maintains the redirection of that traffic to government-run servers (sinkholing), detects the contact attempts there and notifies those affected via their internet provider. After the June action the BSI additionally informed affected organisations directly about leaked StealC credentials; the same procedure can be expected now.

The 6.4 million datasets are the part with the longest after-effect for organisations. Credentials a stealer harvested months ago still work today if nobody changed them – passwords, but also session cookies that allow MFA to be bypassed. The experience from earlier Endgame waves: the infrastructure is back within weeks to months, often under a new name. StealC is the proof – hit in June, back online with more than a hundred servers in November.

What to do now.

1. Check exposure. Europol passes the secured data to Have I Been Pwned and partner agencies; run the HIBP domain search for all your mail domains, and check the abuse contact’s inbox and your provider’s notices for BSI notifications.
2. Rotate credentials, not just passwords. For every affected account: change the password, revoke active sessions and tokens (Microsoft 365: revoke sign-in sessions), delete browser profiles on the affected machines. A stealer takes cookies with it; a new password alone does not help.
3. Hunt for traces. Gootloader leaves JavaScript files and scheduled tasks in the user profile (%APPDATA%, task scheduler entries with wscript/cscript); StealC usually runs as an inconspicuous process with HTTP connections to changing IP addresses. In XIEM: Syscollector check for new scheduled tasks, Sysmon event 1 for wscript.exe from user directories, egress logs for HTTP POST to bare IP addresses.
4. Check your own website. If you run WordPress: core, plugins and themes up to date, verify file integrity, search the database for foreign posts with download links. A hit means your own domain served as bait.
5. Address download behaviour. Templates for contracts and agreements come from legal or an approved source, not from a forum post ranked third in search results. JavaScript files from the internet should not be executable in the first place – one file-type association entry is enough.

Context.

Operation Endgame is the rare case in which law enforcement starts at the right end of the chain: at initial access, not at the ransom. Every seized loader server is a ransomware attack that does not happen – at least for a while. That StealC had to be hit a second time shows the limit: the operators rebuild, the authorities clear out, and in between lie months in which the stolen credentials are in circulation.

For entities subject to NIS2, this action week is a reason to review how they handle leaked credentials: is there a process that turns a BSI notification into a rotation and a search on the affected systems within hours? Article 21 requires exactly that capability – detecting and handling incidents – and a notification from outside is the simplest incident there is.