U.S., European, Australian and Canadian police seize 235 servers and 257 domains behind Gootloader, CastleRAT and StealC

Police agencies in the United States, Europe, Australia and Canada seized 235 servers and 257 domains linked to Gootloader, CastleRAT and StealC, according to Europol. The operation targeted distribution infrastructure for malware sold as services: Gootloader as a dropper, CastleRAT as a remote access trojan active since at least 2025, and StealC as an information stealer. Europol said the takedown severely crippled their ability to infect new machines.

The U.S. Justice Department tied Gootloader, active since at least 2018, to more than 25,000 infected computers and about $28.8 million in U.S. damages, saying the latest action, part of Operation Endgame, removed the dropper from 100 servers. Europol reported seizing 14 Gootloader servers and 218 domains, then cleaning 681 compromised websites. For CastleRAT, a remote access trojan used to deploy ransomware, investigators seized 120 servers and 39 domains plus victim data; HaveIBeenPwned said 180,000 email addresses and 893,000 unique passwords were recovered.

StealC, active since at least 2023, was hit again after earlier enforcement this year, with 102 servers disrupted and 6.4 million victim credentials seized and shared with HaveIBeenPwned, the Dutch Institute for Vulnerability Disclosure, CheckjeHack, NoMoreLeaks, Sekoia, Shadowserver and the NL-NCSC. The pattern shows law enforcement moving from individual arrests to dismantling hosting, command and distribution layers that let small operators run cybercrime as a service.

The immediate effect is reduced infection capacity, but the recovered data shows the risk is already embedded: stolen emails, passwords and identities can be resold and reused for ransomware or account takeover. Small businesses and individuals exposed through fake legal documents, compromised sites or infected machines remain vulnerable until credentials are changed and systems are cleaned. The seizure is a concrete countermeasure against decentralized malware ecosystems.