Authorities Seize 257 Domains and 235 Servers in Malware Crackdown

By Olivia Hart

Law-enforcement agencies seized 257 domains and 235 servers used by the Gootloader, CastleRAT and StealC malware operations, according to Europol.

Agencies in Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States joined the action. Europol and Eurojust coordinated it, while private partners helped identify, take down, seize and block the three malware operations’ infrastructure.

The sweep forms part of Operation Endgame, an international law-enforcement effort against cybercrime and “cybercrime-as-a-service” networks. Together, the participating agencies struck at infrastructure that cybercriminals used to distribute malware, harvest stolen information and support later attacks.

What did police target?

• Gootloader is a malware loader active since 2020.
• StealC is an information stealer that exfiltrates credentials, cryptocurrency wallets and other sensitive information from infected devices.
• CastleRAT is a remote-access trojan that surfaced last year.

Cybercriminal operations, including ransomware gangs, have used all three malware families.

The infrastructure search produced a particularly large haul of victim data. Europol said: “During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week.”

The suspects sold credentials taken after infecting victims and reused them for later cyberattacks, including ransomware, Europol said. Authorities also identified 6.4 million victim datasets on the targeted criminal infrastructure. Those datasets came from malware-infected systems and were earmarked for use in other cyberattacks, including ransomware breaches.

Where will the stolen data appear?

Victim data will become available through HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC. The platforms will alert victims to stolen credentials linked to CastleRAT malware.

Past Operation Endgame rounds show how quickly the scope has expanded. In June, authorities cleaned nearly 15,000 malware-infected WordPress websites and seized 106 servers used by the SocGholish botnet and the Evil Corp Russian cybercrime group.

Later that month, the operation disrupted Amadey and StealC infrastructure, taking down 326 servers and 142 domains. Law enforcement recovered around 27 million credentials from more than 385,000 compromised systems.

One year earlier, the same joint action took down more than 1,000 servers used by the Rhadamanthys, VenomRAT and Elysium botnet malware operations. Earlier rounds also targeted Smokeloader botnet customers and servers, ransomware infrastructure and the AVCheck site.

The operation’s wider list of major malware targets includes DanaBot, IcedID, Pikabot, Trickbot, Smokeloader, Bumblebee and SystemBC.

What does this takedown change for defenders?

Europol’s immediate instruction to WordPress users is straightforward: update credentials, enable multi-factor authentication and patch vulnerabilities. The 6.4 million identified victim datasets also give exposure teams a concrete way to find affected accounts and remove stolen credentials before criminals reuse them in follow-on attacks.

Separately, Adaptive Security says its AI agents analyze email intent, context and behavior to uncover phishing, business email compromise and invoice fraud. The company offers a free 14-day, read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

For enterprise defenders, the practical takeaway is to treat exposed credentials as reusable attack material: rotate them, require multi-factor authentication and patch known vulnerabilities now.