Operation Endgame seizes 235 servers and 6.4 million stolen logins in Gootloader takedown
Police in nine countries disrupted the infrastructure behind Gootloader, CastleRAT and StealC in an operation running November 9–11. But no arrests were announced, and the stolen logins still work until victims change them.
The News
International law enforcement has disrupted the infrastructure behind three pieces of malware — Gootloader, CastleRAT and StealC — in an Operation Endgame action that ran from November 9 to 11. Europol announced it on November 12 and the US Department of Justice on November 13. Police in nine countries seized 235 servers and 257 domains and secured about 6.4 million stolen login credentials belonging to more than 40,000 victims.
For Gootloader specifically, police took down 14 servers and 218 domains and cleaned 681 hacked websites. Gootloader is a “loader” — malware whose job is to sneak onto a computer and then download other malware, including ransomware. The Justice Department says it has infected at least 25,000 computers worldwide since 2018 and was used in ransomware attacks on at least 44 US victims, causing about $28.8 million in losses. US agencies removed the malware from more than 100 servers, including compromised WordPress sites, and seized US domains used to deliver and control it.
The numbers come with a gap. German police put Gootloader's total infections far higher — millions of computers since 2020 — a figure the Justice Department's 25,000 does not reconcile with. And no arrests were announced, which means the people behind the operation may still be free to rebuild. The seized logins are also a warning, not a rescue: they still work until the victims change them, so the haul measures what was already stolen, not what was recovered.
235 servers seized, 6.4 million logins recovered — and no arrests.
Why It Matters
This is the kind of takedown that looks like a win on the first read and a warning on the second. Taking 235 servers and 257 domains offline disrupts the delivery chain for three malware families at once, and cleaning 681 hacked websites removes landing pads that were infecting visitors. That is real damage to the operation. But loaders are infrastructure, and infrastructure can be rebuilt — especially when no one has been arrested.
The 6.4 million stolen logins are the sharper point: every one of them is still a live key to someone's account until it is changed, and the victims, more than 40,000 of them, may not even know they are in the haul. For security vendors, takedowns like this are both a showcase and a reminder: the demand for their products does not fall when a botnet dies, because the next one is already being built.
There is also a pipeline effect worth naming. Gootloader was a first step, not the final attack: it opened the door, and ransomware groups walked through it. The Justice Department links it to at least 44 US ransomware victims and $28.8 million in losses, which is the measurable tail of a much larger infection count. Every loader takedown breaks that pipeline for a while, but the economics that built it — stolen logins are cheap, ransomware pays — do not change when servers are seized.
Analyst's Take
Mixed is the honest verdict here. The disruption is large — 235 servers, 257 domains, three malware families — and the Gootloader numbers, 25,000 infections and $28.8 million in US losses, show why police spent the effort. But the two caveats matter more than the headline: no arrests, and a 6.4-million-login haul that only helps if victims act on it.
What to watch next is simple: whether any arrests follow, whether Gootloader infrastructure reappears under new domains, and whether the victims behind those 6.4 million logins are told and act. A takedown with no arrests is a pause, not an ending.
CrowdStrike and Palo Alto Networks are the read-through tickers here, not participants: takedowns validate the market for endpoint and network security, but they do not move a vendor's quarter. The trade is unchanged — the threat keeps regenerating, and the vendors keep selling the tools to fight it. Reader poll: does this takedown change your view on the security vendors? Bullish: the threat keeps the spending coming. Bearish: takedowns don't move the stocks.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is Gootloader?
Gootloader is a “loader” — malware that sneaks onto a computer and then downloads other malware, including ransomware. The US Justice Department says it has infected at least 25,000 computers worldwide since 2018, though German police put the total far higher, at millions of computers since 2020.
What did Operation Endgame actually seize?
Police in nine countries seized 235 servers and 257 domains and secured about 6.4 million stolen login credentials belonging to more than 40,000 victims. For Gootloader alone, 14 servers and 218 domains were taken down and 681 hacked websites cleaned.
Why is the verdict Mixed if police won?
The disruption is real, but no arrests were announced, so the people behind the operation may rebuild, and the 6.4 million seized logins still work until victims change them. The infection counts from the US and German authorities also do not agree.
What are CrowdStrike and Palo Alto Networks doing in this story?
They are read-through tickers, not participants. They are listed cybersecurity vendors, included because law-enforcement takedowns like this shape demand for their products. No public company runs Gootloader.
👁
Source: GBHackers