Police in nine countries have dismantled large parts of the criminal infrastructure behind three malware kits that enabled ransomware attacks and data theft, seizing 235 servers and 257 domains and identifying credentials belonging to 6.4 million victims, Europol announced Thursday.
The operation, carried out with private-sector partners, targeted the “cybercrime-as-a-service” market, where malware toolkits are built and maintained by one set of actors and sold or rented to others who use them for intrusions, extortion and fraud. Agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States took part, alongside Europol and Eurojust, as part of Operation Endgame, which Europol calls the largest international effort against ransomware enablers, with more than 30 public and private partners.
The largest seizures involved CastleRAT, a remote access trojan known since 2025 that gives attackers remote control of infected computers. Authorities seized 120 servers and 39 domains linked to the tool, whose anti-detection mechanisms had made it difficult to identify.
Gootloader, a dropper spread through fake legal documents hosted on hacked WordPress sites, served as an initial access vector for ransomware attacks. Police took down 14 servers and 218 domains connected to the kit and cleaned up 681 infected websites.
StealC, described as a stealer with dropper functions, was designed to extract passwords, data and credentials from compromised machines for resale and fraudulent use. Investigators dismantled 102 servers tied to it, building on seizures carried out in June 2026.
The seized infrastructure held more than 6 million sets of victim credentials, which the suspects had collected after infecting victims and offered for sale for use in further attacks, including ransomware. Victim data will be made available through platforms including HaveIBeenPwned, the Shadowserver Foundation and the Dutch National Cyber Security Centre, among others, so victims can learn whether their credentials were compromised.
In the announcement, authorities advised WordPress users to update credentials, enable multi-factor authentication and patch vulnerabilities.
Operation Endgame is a multinational effort targeting cybercrime since 2024, particularly focused on removing malware that serves as the foundation for a large number of financially motivated crimes.
Source: CyberScoop · 2026-11-12