In a significant blow to cybercriminal activities, Europol and its international collaborators have dismantled infrastructure linked to notorious malware networks, including Gootloader, CastleRAT, and StealC. The operation, announced on November 12, 2026, successfully targeted 235 servers and 257 domains, disrupting services that facilitate ransomware and data theft.
Targeting Cybercrime-as-a-Service
This coordinated effort focused on the cybercrime-as-a-service model, where malicious actors offer tools and access to other criminals for network breaches. By taking down the servers and domains, authorities effectively disrupted various stages of the attack chain, rather than only addressing the final ransomware payload.
Europol’s action underscores the importance of dismantling the infrastructure that supports malware operations, which are often linked to password theft, unauthorized remote control, and the deployment of ransomware.
Impact on Gootloader and CastleRAT
Gootloader, known for luring victims through fake legal documents on compromised websites, saw significant disruptions. Authorities took down 14 servers and 218 domains, also cleaning 681 infected websites. Gootloader’s use of search poisoning to direct users to malicious downloads highlights the sophisticated methods employed by cybercriminals.
Meanwhile, CastleRAT, which has been active since 2025, provides attackers with remote access to compromised computers. The operation resulted in the seizure of 120 servers and 39 domains. CastleRAT is notable for its keylogging, screen capture, and clipboard monitoring capabilities, which are critical for attackers seeking to collect sensitive information.
Addressing Stolen Credentials and Victim Support
StealC, another target of the operation, focuses on stealing passwords and digital identities. Europol dismantled 102 servers associated with this malware, continuing its efforts from a previous operation in June 2026. This ongoing pressure aims to dismantle persistent criminal networks.
Victim data will be used for alerts through platforms like Have I Been Pwned and others, providing support and notification to affected individuals. Europol, with its European Cybercrime Centre, alongside Eurojust, played crucial roles in intelligence gathering and judicial coordination.
In light of these developments, WordPress site owners are advised to enhance security measures, such as changing credentials, enabling multifactor authentication, and patching vulnerabilities to prevent reinfection.
While the takedown is a critical step towards disrupting cybercriminal infrastructure, users are reminded to secure their accounts and systems to mitigate any remaining risks.
