Operation Endgame: Gootloader, CastleRAT and StealC taken down, are your passwords among the 6.4 million?
This week, police in nine countries, coordinated by Europol and Eurojust, dismantled the infrastructure of three pieces of malware widely used by ransomware gangs: Gootloader, CastleRAT and StealC. The tally announced by Europol: 235 servers and 257 domain names seized or taken down, and more than 6.4 million datasets stolen from victims found on the criminals’ servers.
This new phase of Operation Endgame also involves Canada: the RCMP and the Ottawa Police Service are among the partners in the Gootloader investigation, according to the U.S. Department of Justice. For a small business, the practical question is simple: are your passwords in the haul, and was your WordPress site used as bait?
What Operation Endgame hit
How Gootloader trapped its victims
Gootloader didn’t rely on a suspicious email. It counted on an everyday habit: searching Google for a document template. According to the Dutch police, the criminals pushed hacked websites to the top of search results.
🔎
1. The search
An employee searches for an agreement or contract template.
🌐
2. The hacked site
A legitimate but compromised WordPress site shows up among the top results.
📄
3. The fake document
She downloads the "legal document" offered: it’s the malware.
🚪
4. Access for sale
The computer joins a network of infected devices whose access is sold.
🔒
5. The ransomware
A gang buys the access, moves through the network and encrypts the files.
The U.S. Department of Justice links Gootloader to ransomware attacks on at least 44 U.S. victims, with losses of about US$28.8 million.
Your WordPress site may have been used as bait
The 681 cleaned sites belonged to organizations that never asked for any of this. Europol urges WordPress users to change their credentials, turn on multi-factor authentication and apply patches. Four rules to check with whoever runs your site:
Four rules so your site isn’t used as bait
🔑 One named account per person
No shared "admin" account; every login is tied to a person and removed when they leave.
📲 Multi-factor authentication for every admin
A password stolen by StealC is no longer enough to open the dashboard.
🧩 Plugins and theme up to date, the rest deleted
A deactivated plugin that is still installed remains a possible way in.
🕵️ Unknown pages flagged
Pages you never created, often about document templates, are a classic sign of compromise.
We’ve already explained how stolen UpdraftCentral keys became a WordPress backdoor and why you should quickly apply the WordPress CVE-2026-119977 update.
Are your passwords in the haul? Three situations
CastleRAT victim data is being passed to alert services such as Have I Been Pwned (HIBP). On November 13, 2026, HIBP added about 179,700 email addresses and 893,000 unique passwords linked to CastleRAT. That’s only part of the 6.4 million datasets: more may be added in the coming weeks, according to the Dutch police.
📧
A company address is flagged
HIBP alert or partner notice
✔ Act the same day
- Change the password from a clean device
- Change it everywhere it was reused
- Turn on multi-factor authentication
⚠ Don’t stop at the password
- Revoke open sessions in Microsoft 365
- Check email forwarding rules
🔐
A password shows up in Pwned Passwords
Check through your password manager
✔ Treat it as public
- Replace it on every account that uses it
- Switch to unique passphrases generated by the manager
⚠ Never type a password into an unknown checking site
- Use your manager’s built-in check
💻
A device is flagged as infected
Notice from an internet provider or agency
✔ Disconnect it from the network
- Have it cleaned or reinstalled before any sign-in
- Then change the passwords used on that device
⚠ Changing passwords on a still-infected device is pointless
- Check the other computers on the same network
🍪 Why changing the password isn’t always enough
A stealer like StealC can also take session tokens: the session stays open even after a password change. Revoke sessions and check registered devices, as we explained in our article on Microsoft 365 session theft.
How NeoTech can help
For our managed IT services clients, we check your domain’s addresses against breach notices, enforce multi-factor authentication and a password manager, and provide automated 24/7 monitoring with on-call technician intervention when a sign-in or a computer behaves abnormally. We can also review the accounts and plugins on your WordPress site.
Book your free cyber check
In 30 minutes, we check whether addresses from your domain appear in known leaks, the state of your multi-factor authentication and the access to your WordPress site.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Europol — 6.4 million victim datasets secured in international operation against malware networks
- U.S. Department of Justice — Gootloader Malware Disrupted in International Cyber Operation (Nov. 12, 2026)
- Politie (Dutch police) — International action disables cybercriminal network
- Have I Been Pwned — CastleRAT Data Breach
- Help Net Security — Operation Endgame malware takedown turns up over 6 million stolen logins
Photo: Sora Shimazaki, Pexels (Pexels licence).