Law enforcement agencies as part of Operation Endgame disrupt and dismantle servers and domains tied to the Gootloader, CastleRAT and StealC malware operations. Across reporting, the tools are described as enabling intrusions, credential theft, and, in some cases, ransomware activity by criminals.
Authorities also seize large volumes of compromised victim credentials. Multiple outlets say approximately 6.4 million stolen logins belonging to more than 40,000 victims are recovered, attributing the figure to Germany’s Federal Criminal Police Office (BKA) in at least one report. The action is framed as targeting the “services” or infrastructure used by ransomware groups to gain access to corporate networks.
Outlets largely agree on the malware family names and the credential seizure scale, while differing in which operational details they foreground, such as the number of servers and domains seized or the number of participating countries. The coverage also varies slightly in emphasis, from technical infrastructure disruption to the downstream impact of stolen logins reaching ordinary users and organizations.
