An international police operation took down servers linked to Gootloader, CastleRAT and StealC this week. Police also seized about 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany’s Federal Criminal Police Office, or BKA.
Gootloader and its reach
Gootloader is a loader that could download other malware once it was on a computer, especially ransomware. It spread through fake legal documents placed on hacked websites, often WordPress sites, and criminals used SEO poisoning to push those sites high in search results. The U.S. Justice Department said it has infected at least 25,000 computers worldwide since 2018.
Its operators used infected computers to spread the malware to more systems, then sold access to the newer ones to ransomware criminals. In the U.S., investigators tied Gootloader to ransomware attacks against at least 44 victims, with losses of about $28.8 million.
German police gave a much higher count in their own statement in German. Based on what investigators know so far, they said Gootloader has infected millions of computers worldwide since it first appeared in 2020.
Servers, domains and websites seized
Across the three tools, police seized 235 servers and 257 domains, according to an operation summary from Europol. The takedown was part of Operation Endgame, an international police campaign against malware criminals use to access victims’ computers.
For Gootloader, police took down 14 servers and 218 domains and removed malware from 681 hacked websites. With court approval, U.S. agencies and their international partners removed Gootloader from more than 100 servers, including hacked WordPress sites, and seized U.S. domains used to deliver and control the malware, according to the Justice Department announcement.
CastleRAT, a remote access trojan known since 2025, lets attackers control an infected computer remotely. Police seized 120 of its servers and 39 domains. StealC is an infostealer that exfiltrates passwords and other login credentials from infected computers, allowing criminals to sell or misuse them. Police took down its servers again this week, after a June operation against it.
StealC, hosting and arrests
After the June action, StealC’s operators changed their infrastructure and brought it back online to keep it out of investigators’ reach, German police said. Some of its key infrastructure ran on Virtualine/Omegatech, a bulletproof hosting service that advertised to criminals. Police shut that hosting service down in a late-October takedown.
No arrests were announced in this week’s action. Dutch police also carried out further investigations targeting Gootloader’s main suspect, according to their news release.
What victims and site owners can do
Dutch police loaded data stolen by CastleRAT into Check your hack, a police service where people can enter an email address. If the address is in the data, police send an email within a few minutes with steps to remove the malware. If it is not, no email arrives.
More data will be added in the coming weeks. The service checks single addresses, not whole domains, but organizations can join No More Leaks, a police project that shares data with private partners. The stolen data is also being shared with services including Have I Been Pwned and the Shadowserver Foundation. Emails that claim to come from the police and ask people to check the data are fake, and police never send emails with links.
Even after police seize the data, criminals may still have the stolen logins, according to the police FAQ. As long as the malware stays on a computer, criminals may also keep getting its passwords.
The Shadowserver Foundation is working with internet service providers and computer security incident response teams to find infected computers and notify their owners, the Justice Department said. In Germany, the Federal Office for Information Security is helping notify victims, according to the BKA.
WordPress site cleanup and advice
Denmark’s National Special Crime Unit helped clean the 681 websites. In a statement in Danish, the unit said it believes the attackers got into the sites with stolen passwords that came through criminal channels, then installed a backdoor. Officers removed the attackers’ code and access, and left a message for site owners with advice on securing their sites.
Police in Denmark and the Netherlands advise WordPress site owners to change all administrator passwords to unique, at least 12-character passwords, turn on multi-factor authentication, remove accounts they do not recognize, remove any backdoor code from the site, update WordPress, its themes and its plugins, and allow access to the /wp-admin login page only from the IP addresses of their own devices.
Licensed under CC BY-ND 4.0 International