What was seized
The countries involved were Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States. Europol and Eurojust coordinated. Europol and private-sector partners took 235 servers and 257 domains out of the criminals' hands. Help Net Security gives the split by malware family:
| Malware | Servers | Domains |
|---|---|---|
| Gootloader | 14 | 218 |
| CastleRAT | 120 | 39 |
| StealC | 102 | not itemised in the source |
German police material, as relayed by Newsflash24, says the measures ran from 9 to 11 November. It also says more than 230 servers worldwide were affected, over 40 of them in Germany.
Reports I found don't mention any arrests, so treat this as a disruption and seizure. It isn't a permanent end to these operations.
Three tools, three jobs
- Gootloader is a loader, meaning its job is to get onto a machine and pull down other malware. Europol says it gave attackers unauthorised access by distributing fake legal documents through compromised websites. German authorities describe the lure as manipulated search results that led users to booby-trapped websites. For readers, that means a document search can be an infection route.
- CastleRAT is a remote access trojan. Europol says it has been known since 2025. Europol says its use led to encrypted data, crippled IT systems and ransom payments.
- StealC is an infostealer that can also drop other malware. This week's action continues work against StealC that began in June 2026.
Gootloader's start date differs between sources. BleepingComputer says Gootloader has been active since 2020. Help Net Security says it has been known since 2025. I'd go with BleepingComputer's 2020 and treat the other figure as a likely slip.
The stolen-credential numbers
BleepingComputer reports Europol's statement that the suspects used the stolen credentials to sell them, and for later attacks such as ransomware. The headline figure is 6.4 million victim datasets. Europol's quoted text says "over 6 million" credentials. These are probably different units, so don't read them as the same count.
Victim data is meant to reach people through several services. BleepingComputer's report of Europol's statement lists HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC. That statement refers specifically to credentials stolen by CastleRAT. I can't confirm that every service holds records from all three families, or that every victim will be alerted.
WordPress angle
Gootloader relied partly on compromised websites. Europol says 14 servers and 218 domains were taken down and another 681 compromised websites were remediated. Europol urges WordPress users to change credentials, turn on multi-factor authentication and patch vulnerabilities. The reports I found don't name a specific vulnerability or plugin.
For site owners, a sensible checklist based on that advice:
- Rotate admin and hosting credentials.
- Turn on MFA for every administrator account.
- Update WordPress core, themes and plugins.
- Review user accounts for any you don't recognise. This comes from the Dutch police advice in the June SocGholish cleanup, not from this action.
If your PC may have been infected
This guidance comes from the Dutch police's June notice about the separate Amadey/StealC phase. It still applies to any infostealer infection. The police say victims should assume every account ever logged into on the infected device is in criminals' hands, and that changing only the password named in a notification isn't enough. Their advice is to change the login details of every account used on that device and enable two-factor authentication where possible.
In practice:
- Clean or reimage the machine first. Otherwise new passwords go straight back to the thief.
- Then rotate passwords from a known-clean device, starting with email, banking, password managers and work accounts.
- Revoke active sessions and tokens, since stolen data can include more than passwords.
- Prefer MFA that resists phishing where you can. This is general industry practice, not a claim from the reports.
- Check your email address on Have I Been Pwned.
Why this isn't the last chapter
This isn't the first strike on these tools. In June, a separate phase hit Amadey and StealC. German authorities say the offenders adapted their infrastructure and put it back into operation to escape investigators. BleepingComputer made a similar point after the June action: unless arrests are made, threat actors commonly rebuild infrastructure.
Microsoft was named as a partner in the June phase, but the reports I found don't name it in this November action. Don't read the two as the same operation. The June figures were 326 servers and 142 domains, with about 27 million credentials from more than 385,000 systems. They are separate from the November totals.
Bottom line
Seizing infrastructure won't clean an already infected PC or un-steal a password. If you've been told your data turned up in one of these sets, act on it. If you haven't, use the week to tighten MFA, patch your WordPress sites and take a second look at documents that arrive through search results.