# Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins

Source: [The Hacker News](https://thehackernews.com/2026/11/operation-endgame-takes-down-gootloader.html) · 2026-11-13 · Security
Page: https://themorning.dev/story/operation-endgame-takes-down-gootloader-castlerat-and-stealc-servers-seizes-6-4m-5df4bf07aed5b496
Kind: security · Impact: high

## In brief

- An international police operation, Operation Endgame, took down servers behind Gootloader, CastleRAT and StealC.
- Investigators seized 235 servers and 257 domains.
- Police also seized about 6.4 million stolen victim logins.

## Why it matters

Criminals used these three tools to gain access to computers, steal passwords and launch ransomware attacks, so the takedown disrupts a supply of access and credentials, though the sources do not say how long the disruption will last.

## Timeline

- 2026-11-13: Operation Endgame disrupts Gootloader, CastleRAT and StealC servers and seizes 6.4M stolen logins

## Coverage

- [Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins](https://thehackernews.com/2026/11/operation-endgame-takes-down-gootloader.html) — The Hacker News, 2026-11-13
- [Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure](https://www.securityweek.com/law-enforcement-disrupts-gootloader-castlerat-and-stealc-infrastructure/) — SecurityWeek, 2026-11-13

Tags: malware, ransomware, law-enforcement, operation-endgame, credentials

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev