Europol says Operation Endgame seized 235 servers and 257 domains behind Gootloader, CastleRAT and StealC

The release's own toolkit lines add to 236 servers, not 235

Europol's press release of 12 November 2026 says that "law enforcement seized 235 servers and 257 domains" behind three malware toolkits. Its own per-toolkit lines give 14 servers for Gootloader, 120 for CastleRAT and 102 for StealC. Those add to 236 (derived), one more than the headline total. The domains do match: 218 for Gootloader plus 39 for CastleRAT is 257 (derived), and the release states no domain figure for StealC.

The one server gap does not show that either number is wrong. The release does not say whether it comes from overlap between toolkits, rounding or a typo, and this site does not guess. What the gap does show is how loosely the figures on the page are tied together. The same page also mixes units: "6.4 million victim datasets" in the headline against "6.4 million victim credentials identified" in a body heading and "over 6 million victim credentials" in the text. It uses five different verbs for what was done to servers, domains and websites, and defines none of them.

Read as: Europol's page, rendered in a browser at about 17:35 UTC on 12 November 2026. The page needs JavaScript, so a plain request returns only a loading shell. The page's own metadata dates it 13:00 UTC that day. Every figure marked derived was worked out by this site from numbers printed on that page. The release is an official statement and is treated here as a claim by Europol, not as an independent count.

What Europol says happened

Europol says it, "alongside global partners, has dismantled the criminal infrastructure behind Gootloader, CastleRAT, and StealC malware" and that the operation targeted "cybercrime-as-a-service" models that enabled further crimes such as ransomware and data theft. It describes three toolkits. Gootloader is "a so-called dropper/loader" that spread fake legal documents through compromised websites, "often via hacked WordPress sites". CastleRAT is "a remote access trojan (RAT) known since 2025". StealC is "a so-called stealer with dropper function" spread "through multiple attack vectors". For each it prints servers, domains and sometimes a third figure, shown below next to the sums this site worked out.

Zoom

The release lists nine countries (derived count from its list): Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, with 13 national bodies between them (derived), plus Europol, Eurojust and EMPACT. Europol says its European Cybercrime Centre "provided critical support, including cyber intelligence, financial tracing, and victim notifications". It calls Operation Endgame "the largest-ever international effort against ransomware enablers, with over 30 public and private partners". That is Europol's own description and the release does not itemise the partners. The Operation Endgame website frames this action as Season 4; the release does not use that word.

How each toolkit reaches a victim, and where the cut lands

The release gives each toolkit a different route into a victim and a different harm. Gootloader reaches people who download fake legal documents. CastleRAT is described as letting attackers control an infected computer "from a distance". StealC, the release says, was "spread through multiple attack vectors" and none is named. On harm, Gootloader led to "ransomware installation for digital extortion", CastleRAT's use "resulted in the encryption of numerous data sets" and forced companies and organisations to pay ransom, and StealC was "primarily designed to extract sensitive information such as passwords, stored access data and digital identities".

Zoom

The release also says CastleRAT "featured a modern technical architecture" and "employed mechanisms that made its detection difficult". Those are Europol's descriptions; the release prints no technical evidence for either. The cut the release describes lands on servers and domains. It does not say what happened to the computers already infected, and it does not say what happened to the ransomware operators who used the toolkits.

Five verbs, no definitions

The headline sentence says law enforcement "seized 235 servers and 257 domains". The next paragraph says the same 235 and 257 "were actioned by law enforcement together with private parties". The toolkit lines then use three more verbs: taken down, seized and dismantled. Websites are "remediated". The release defines none of them.

Derived: in the toolkit lines, "seized" describes only CastleRAT's 120 servers and 39 domains. That is 50.8 percent of the 236 servers and 15.2 percent of the 257 domains. Gootloader accounts for 218 of the 257 domains (84.8 percent, derived) and only 14 of the 236 servers. A total described as seized is therefore built from lines most of which say something else. That is a point about wording, not a claim that anything was misdescribed.

Datasets, credentials and the one toolkit named for alerts

The unit of the headline figure changes inside the page. This table sets the four phrasings side by side.

A dataset and a credential are different units, and the release does not say how many credentials a dataset holds, whether one victim is one dataset, or how many of the 6.4 million are unique or still valid. It also says the credentials were identified in infrastructure "seized by the authorities during this week", which does not tell a reader which of the three toolkits held them.

The alert sentence narrows it further. The seven platforms are named "alerting victims of stolen credentials caused by the CastleRAT malware". The release describes StealC as "primarily designed to extract sensitive information such as passwords, stored access data and digital identities", yet it does not say whether the 6.4 million belong to CastleRAT alone or to all three toolkits, or whether StealC and Gootloader victims will be alerted at all. CastleRAT's 120 servers are 50.8 percent of the 236 (derived), so the one toolkit named for alerts holds about half the servers and the release gives no victim count for it.

The June 2026 action, as the Endgame site reproduces Europol's release of 24 June 2026, used a similar sentence: "as many as 27 million stolen login credentials have been recovered", with "326 servers and 142 domains" actioned across SocGholish, Amadey and StealC. That release named Spamhaus among the notification platforms and Microsoft among the partners; the November release names Sekoia and no company as a partner. The November StealC line says "continuing efforts from June 2026" and does not say whether its 102 servers are inside or on top of the 326 from June.

Secured is not cleaned

The headline says the datasets were "secured". The body says the credentials were "identified" and that victim data "will be made available" through the platforms. Those are three different states. Identified in seized infrastructure is a finding about the criminals' copy. Made available later is a plan. Neither says that any victim has been told, that any credential has been reset, or that any infected computer has been cleaned. The only cleaning the release reports is Gootloader's 681 infected websites "remediated".

The same applies to "severely crippling". The release says the actions severely crippled the distribution networks. It prints no measure of the toolkits' activity before or after, so the phrase is Europol's assessment and not a figure.

What the release states, and what it does not

Where the sources differ

What to do, in order

The release gives one instruction: "WordPress users are urged to update credentials, enable multi-factor authentication, and patch vulnerabilities." It does not tell other readers what to do. The steps below mark which are Europol's and which are this site's suggestions.

Technical details

The release prints no indicator, hash, domain, address, file name, query or detection rule, and this article adds none from any secondary source. What it prints is figures and wording. The first block holds the release's own lines about numbers, copied exactly. A defender or analyst can compare any later restatement of the takedown against them.

In coordinated actions, law enforcement seized 235 servers and 257 domains, severely crippling these malware distribution networks.
During the action, 235 servers and 257 domains were actioned by law enforcement together with private parties.
14 servers and 218 domains were taken down; 681 infected websites remediated.
120 servers and 39 domains were seized, with victim data shared for alerts.
102 servers were dismantled, continuing efforts from June 2026.
During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week.

The second block is the release's alert and WordPress sentence, copied exactly. It names the seven platforms where victim data is to be made available, which is where an organisation checks for exposure.

Victim data will be made available via platforms HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC, alerting victims of stolen credentials caused by the CastleRAT malware. WordPress users are urged to update credentials, enable multi-factor authentication, and patch vulnerabilities.

The third block is arithmetic done by this site on the release's figures, so every line is derived. Where the release is silent, the line says so.

servers: 14 + 120 + 102 = 236 (release states 235; difference 1)
domains: 218 + 39 = 257 (release states 257; StealC domains not stated, left out)
servers described as seized: 120 of 236 = 50.8 percent
domains described as seized: 39 of 257 = 15.2 percent
domains that are Gootloader's: 218 of 257 = 84.8 percent
servers that are CastleRAT's: 120 of 236 = 50.8 percent
countries listed: 9; national bodies listed: 13

The question the release leaves open

If the headline counts datasets, the body counts credentials, and the alert sentence covers only credentials caused by CastleRAT, who tells the victims of the other two toolkits that their data was in the seized infrastructure, and how would they ever know?

Key facts