International police seize 6.4 million stolen logins in Gootloader, CastleRAT and StealC takedown

International police seized 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC this week, and recovered about 6.4 million stolen logins linked to more than 40,000 victims, according to Germany’s Federal Criminal Police Office and Europol. The tools gave attackers footholds, remote control and password theft, then fed access into ransomware operations. The action was part of Operation Endgame, a cross-border campaign against malware that criminals use to break into computers and sell that access.

The evidence trail shows Gootloader operated as a loader: it arrived through fake legal documents on compromised websites, often WordPress sites boosted by search-result manipulation, then downloaded ransomware or sold access. The Justice Department says it infected at least 25,000 computers since 2018 and helped drive 44 U.S. ransomware attacks causing about $28.8 million in losses. German investigators say the count may reach millions since 2020. Police took down 14 Gootloader servers and 218 domains, cleaned 681 hacked sites, and seized CastleRAT’s 120 servers and 39 domains.

The pattern is not a single server seizure but a supply-chain disruption. StealC, an infostealer that harvests passwords and credentials, had been hit in June, then rebuilt infrastructure and came back online; its key systems ran on Virtualine/Omegatech, a bulletproof hosting service marketed to criminals that was shut down in late October. Dutch police are pursuing Gootloader’s main suspect, while Europol coordinated the broader Operation Endgame. No arrests were announced, so the action is infrastructure denial rather than a courtroom conclusion.

The stakes sit in the recovered credentials and the infected machines still online. Police warn that criminals may retain stolen logins even after seizure, and that malware must be removed before passwords stop leaking. Dutch police loaded CastleRAT data into Check your hack, while Shadowserver is working with internet providers and incident-response teams to find infected systems and notify owners. For site owners, the takedown removes delivery paths, but users must still rotate passwords and clean devices.