Security Alert
Police seize hundreds of servers in Gootloader, CastleRAT and StealC takedown
Nov 12, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
Europol and partners from nine countries seized 257 domains and 235 servers tied to three malware operations. They also identified 6.4 million victim datasets and over 6 million credentials.
Key points
- Operation Endgame involved nine countries, including Canada.
- Authorities seized 257 domains and 235 servers.
- They identified 6.4 million victim datasets.
- Victim data will be shared through multiple alerting platforms.
Why it matters
This takedown may help limit credential theft and follow-on ransomware attacks. Businesses should still change reused passwords and turn on multi-factor authentication, because stolen data can circulate after a seizure.
Who’s affected: Victims of Gootloader, CastleRAT and StealC
What to do
- Change reused passwords.
- Enable multi-factor authentication.
- Patch WordPress and other exposed systems.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.