An international police operation took down the server infrastructure behind three malware tools this week, and the numbers that came with it are the part worth reading closely.

Officers seized about 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany's Federal Criminal Police Office. They also took 235 servers and 257 domains across the three families, with Europol coordinating support.

The tools are Gootloader, CastleRAT, and StealC. Each one does a different job in the criminal supply chain, and together they cover the full path from initial access to ransomware.

What Each Tool Did

Gootloader was the front door. It spread through fake legal documents planted on hacked websites, many of them WordPress installations. The operators used SEO poisoning to push those pages high in search results, which meant people found them by searching for contracts, agreements, and other documents they legitimately needed.

CastleRAT, seen in the wild since 2025, is the persistent control tool. StealC is the harvest.

The Numbers, and a Discrepancy Worth Noting

The U.S. Justice Department says Gootloader has infected at least 25,000 computers worldwide since 2018. In the U.S. specifically, it was used in ransomware attacks against at least 44 victims, with roughly $28.8 million in losses.

German police gave a much larger figure in their own statement. Based on what investigators know so far, they say Gootloader has infected millions of computers worldwide since it first appeared in 2020.

Those two claims do not line up, and neither agency has reconciled them publicly. The gap between 25,000 and "millions" is not a rounding difference. It may reflect different counting methods, different data sources, or different definitions of what counts as an infection. Treat both figures as claims from the investigating agencies rather than settled numbers.

The Seizures, by Family

Separately, U.S. agencies and international partners removed Gootloader from more than 100 servers with court approval, including hacked WordPress sites, and seized U.S. domains used to deliver and control it.

StealC Came Back Once Already

The StealC detail is the one that should temper any celebration.

Police took it down in June. After that operation, its operators rebuilt their infrastructure and brought it back online, specifically to stay outside investigators' reach.

Some of StealC's key infrastructure ran on Virtualine/Omegatech, a bulletproof hosting service that advertised itself to criminals. Police shut that hosting provider down in a late-October takedown, which appears to have been the precondition for this week's action.

No arrests were announced. Dutch police said they carried out further investigations targeting Gootloader's main suspect.

How the WordPress Sites Got Compromised

Denmark's National Special Crime Unit helped clean the 681 affected websites, and their assessment of the entry path is worth quoting for anyone running WordPress.

The unit believes the attackers got in with stolen passwords obtained through criminal channels, then installed a backdoor.

Officers removed the attackers' code and access, and left a message for site owners with advice on securing their installations.

That is the whole story for most of those 681 sites. Not a WordPress zero-day. Not a plugin exploit. Credentials that were already circulating, used against a login page that was reachable from the internet.

How to Check If Your Data Was Stolen

Dutch police have loaded data stolen by CastleRAT into Check your hack, a service where you enter an email address. If the address appears in the data, the police send an email within a few minutes with steps to remove the malware. If it does not appear, no email arrives.

A few things to know about that service.

• More data will be added in the coming weeks.
• It checks single addresses, not whole domains.
• Organizations can join No More Leaks, a police project that shares data with private partners.
• The stolen data is also being shared with Have I Been Pwned and the Shadowserver Foundation.

And the warning that matters most. Emails claiming to come from the police and asking you to check the data are fake. The police never send emails with links.

That is a real risk here. A takedown announcement is a perfect pretext for a phishing campaign, and criminals know it.

What the Police Themselves Say About Limits

Even after police seize the data, criminals may still hold the stolen logins. And as long as the malware remains on a computer, they may keep harvesting new passwords.

Seizing infrastructure does not un-steal credentials, and it does not clean an infected machine. Those are separate problems.

The Shadowserver Foundation is working with ISPs and national CSIRTs to find infected computers and notify owners. In Germany, the BSI is assisting with victim notification.

What WordPress Site Owners Should Do

Danish and Dutch police published guidance, several items of which appear in a Dutch advice sheet.

• Change all administrator passwords to unique credentials of at least 12 characters.
• Turn on multi-factor authentication.
• Remove accounts you do not recognize.
• Remove any backdoor code from the site.
• Update WordPress, its themes, and its plugins.
• Restrict /wp-admin access to the IP addresses of your own devices.

That last item is the one most site owners skip, and it is the one that would have blocked this entire campaign. If nobody can reach the login page except from known addresses, stolen credentials are worth nothing.

What This Takedown Does and Does Not Fix

It removes infrastructure. That is real, and it disrupts operations for however long it takes the operators to rebuild.

It does not remove malware from infected machines. It does not invalidate stolen passwords. It does not close the WordPress login pages that are still exposed.

The 6.4 million seized logins are a measure of how much had already been taken, not how much has been recovered.

FAQ

What was taken down this week?

Servers and domains behind Gootloader, CastleRAT, and StealC, as part of Operation Endgame. Police seized 235 servers, 257 domains, and about 6.4 million stolen logins belonging to more than 40,000 victims.

What is Gootloader?

A loader that gets onto a computer and downloads other malware, especially ransomware. It spread through fake legal documents on hacked websites, often WordPress, pushed up search results through SEO poisoning.

How many machines did Gootloader infect?

The answers differ. The U.S. Justice Department says at least 25,000 since 2018. German police say millions since 2020. Neither figure has been reconciled publicly.

What is CastleRAT?

A remote access trojan seen since 2025 that gives attackers hands-on control of an infected computer. Police seized 120 of its servers and 39 domains.

Why was StealC taken down twice?

Police shut it down in June, and its operators rebuilt infrastructure and brought it back online. This week's action followed the late-October takedown of Virtualine/Omegatech, the bulletproof hosting service some of its key infrastructure ran on.

How do I check if my email was in the stolen data?

Use Dutch police's Check your hack service. Enter an address, and if it appears in the data, police send an email within minutes with removal steps. If it does not appear, no email arrives.

Are the emails about the data real?

Be careful. Police say emails claiming to come from them and asking you to check the data are fake. They never send emails with links. Go to the service yourself rather than following a link.

How were the 681 WordPress sites compromised?

Denmark's National Special Crime Unit believes attackers used stolen passwords obtained through criminal channels, then installed a backdoor. Not a WordPress vulnerability.

What should WordPress site owners do?

Change all admin passwords to unique 12-plus-character credentials, enable MFA, remove unrecognized accounts, remove backdoor code, update WordPress and everything on it, and restrict /wp-admin to your own IP addresses.

Were there any arrests?

None were announced. Dutch police said they carried out further investigations targeting Gootloader's main suspect.

Does the takedown clean infected computers?

No. It removes infrastructure. Malware on infected machines persists, and as long as it does, criminals may keep harvesting new passwords.

Source: The Hacker News