Science & Tech · Cybersecurity · 1 hr ago
European operation disrupts 235 servers and 257 malware-linked domains
Police from nine countries disrupted 235 servers and 257 domains linked to StealC, Gootloader and CastleRAT malware in an international operation this week.
The operation involved authorities in Germany, the Netherlands, Britain and the United States, as well as private cybersecurity partners.
It was the second major takedown linked to StealC this year, after an earlier crackdown in June; investigators said the malware network had been rebuilt.
Investigators found about 6.4 million stolen login credentials from more than 40,000 victims.
Stolen passwords and login details can put victims’ accounts at risk, so people can check whether their information was exposed at politie.nl/checkyourhack or haveibeenpwned.com.
The operation came with no arrests or criminal charges, and authorities did not report seizing cryptocurrency this time.
Police in nine countries and private-sector partners disrupted 235 servers and 257 domains linked to the StealC, Gootloader and CastleRAT malware.
Investigators found about 6.4 million stolen login credentials, associated with more than 40,000 victims, according to The Record.
The operation targeted infrastructure used to steal data and support further crimes, including ransomware attacks.
Authorities said the operation was part of Operation Endgame, an international effort against cybercrime infrastructure.
No arrests, cryptocurrency seizures or criminal charges accompanied this action, The Record reported.
- Who
- Police in nine countries, Europol, Eurojust and private-sector partners.
- What
- They disrupted servers and domains linked to StealC, Gootloader and CastleRAT and identified stolen credentials.
- When
- The operation took place this week and was announced Thursday, Nov. 12, 2026.
- Where
- The operation involved authorities in nine countries; the articles do not specify where the infrastructure was located overall.
- Why
- The operation targeted malware infrastructure used for data theft, fraud and ransomware attacks.
This story does not have two clearly opposing sides.
Authorities and Microsoft announced an earlier takedown of servers and domains linked to StealC and other malware tools.
The FBI seized the Virtualine bulletproof hosting provider, according to German authorities.
Police and private-sector partners disrupted 235 servers and 257 domains linked to three malware kits.
Europol announced the operation.
- Servers disrupted
- 235
- Domains disrupted
- 257
- Victim credentials identified
- About 6.4 million
- Victims linked to credentials
- More than 40,000
- Countries involved
- 9
- Malware kits
- StealC, Gootloader and CastleRAT
3 sources
What people are saying
Even technically skilled and well-organized cybercriminals must expect coordinated international investigations.
We have once again demonstrated that, together with our international partners and private cybersecurity companies, we can neutralize even seemingly untouchable malware.
Anyone who rebuilds their infrastructure after police action leaves new leads that we will pursue.