We have written previously about multiple “seasons” of activity in Operation Endgame – the largest international public/private operation operation ever undertaken to combat cyber crime enablers globally. Following on from the action against bulletproof hosting provider Virtualine on October 27th 2026, Operation Endgame returned in November 2026. Once again, major enablers of ransomware and other forms of cybercrime such as malware droppers/loaders and information stealers (infostealers) were targeted for disruption by our international Law Enforcement and private sector partners.
“Season 4.0” of Operation Endgame was publicly announced yesterday (2026-11-12), covering joint action taken by law enforcement from Australia (Federal Police – AFP), Bulgaria (General Directorate for Combating Organised Crime – Bulgarian Police), Canada (Royal Canadian Mounted Police – RCMP, Ottawa Police Service), Denmark (Danish Police – Politi), Germany (Federal Criminal Police Office – BKA), France (Brigade de Lutte contre la cybercriminalité – Paris Cybercrime Unit), Moldova (The Centre for Combating Cyber Crime of the National Inspectorate of Investigation of the General Inspectorate of the Police), Netherlands (Netherlands Police – Politie National High Tech Crime Unit, Public Prosecution Office – Openbaar Ministerie), Poland (Central Cybercrime Bureau), United Kingdom (National Crime Agency – NCA) and the United States (Defense Criminal Investigative Service – DCIS, Federal Bureau of Investigation – FBI Denver Field Office, Department of the Army Criminal Investigation Division – Army CID, Department of Justice Criminal Division’s Computer Crime and Intellectual Property Section – CCIPS). International activity was coordinated by Europol and Eurojust, and included technical assistance from partners such as The Shadowserver Foundation, Registrar of Last Resort (RoLR), International Computer Hacking and Intellectual Property (ICHIP) in The Hague, Fraunhofer FKIE, OpenAI and Sharktech, Inc.
In another coordinated operation, key elements of multiple criminal infrastructures behind ransomware and malware operations such as Gootloader, CastleRAT, and StealC were dismantled during the week of 9th-13th November 2026, as part of this ongoing major public-private effort. The goal of the combined action was to continue to disrupt the “assembly lines” cyber criminals use to launch ransomware, financial fraud, and make attacks on critical infrastructure.
Outcomes included:
- 235 servers and 257 domains were seized by law enforcement and private sector partners
- 6.4 million stolen login credentials were recovered as part of the operation
- Cybercrime-as-a-service, malware distribution and credential theft networks disrupted
Data from the operation will once again be shared with National CSIRTs (nCSIRTs) and network owners worldwide for the purposes of victim notification and remediation, with Europol highlighting that victim notifications are crucial for recovery.
Note: since only compromised credentials are being shared, the data contained in the Special Report and any following data visualizations are based on the IP addresses hosting the websites which the compromised accounts are associated with, not the location of the actual CastleRAT victim’s infected computers.
Cybercrime-as-a-Service Disruption
The malware families targeted in this new “season” of Operation Endgame were offered as Cybercrime-as-a-Service, enabling other cyber criminals to target victims – such as for use in deploying ransomware or exfiltrating data. They included:
- Gootloader – a malware dropper/loader that allowed unauthorized access to computer systems by distributing fake legal documents through compromised websites. Victims who downloaded these documents became infected, often via hacked WordPress sites. This approach led to further criminal activities, including ransomware installation and extortion. 14 servers and 218 domains were taken down, and 681 infected websites were remediated.
- CastleRAT – a remote access trojan (RAT) known since 2025 enables attackers to remotely control an infected computer and to misuse it for criminal purposes. CastleRAT featured a modern technical architecture, could be deployed flexibly, and employed mechanisms that made its detection difficult. The use of CastleRAT resulted in the encryption of numerous data sets, the crippling of whole IT systems, and forced affected companies and organizations to pay ransom. 120 servers and 39 domains were seized.
- StealC – information stealing malware with dropper functionality, one of the most pervasive and impactful threats across the cyber crime ecosystem. Spread through multiple attack vectors, this was primarily designed to extract sensitive information such as passwords, stored access data and digital identities from compromised computers, and to make them available for subsequent illicit use, especially data trading and fraudulent use. This can lead to theft of corporate virtual private network (VPN) credentials, single sign-on (SSO) tokens, and session cookies that could allow an attacker to bypass multi-factor authentication (MFA). 102 servers were dismantled, continuing efforts from June 2026.
A new Season 4.0 Episode 1 GootLoader “Thumbs Up?” video covering this latest disruption activity was added to the Operation Endgame website:
New CastleRAT Historical Bot Infections Special Report (Stolen Credentials)
As part of this disruption operation, overnight (2026-11-12) we ran a new one-off CastleRAT Historical Bot Infection Special Report. The purpose is to notify system owners and nCSIRTs about credentials stolen from computers infected with the CastleRAT information stealer malware, so that users can change their stolen credentials and reduce their risk of data loss. Technical details about the content of that report and sample data can be found here.
If you have received a CastleRAT Historical Bot Infections Special Report from Shadowserver, and you need more information, please contact us, and we can provide more details or put you in touch with the Law Enforcement investigating officers if required.
CastleRAT Historical Bot Infections (Stolen Credentials) – Data Analysis
Our new one-off CastleRAT Historical Bot Infections Special Report contained information provided by the Dutch National High Tech Crime Unit (NHTCU). The Special Report covered 2,795,880 individual CastleRAT information stealer events corresponding to 2,501,763 unique stolen login URL/account combinations (there could be multiple passwords stored for a single URL/account combination) associated with websites hosted on 191,997 unique IP addresses, which were spread across 9,872 different Autonomous System Numbers (ASNs) in 161 countries or territories globally.
For each of the images inline, you can click it to view a higher resolution version.
The world maps below show the total number of IP-geolocated websites per country associated with CastleRAT Historical Bot Infections compromised credentials. Note that a relatively small number of IP addresses do not IP-geolocate to a country, so the displayed number is slightly lower than the actual total:
(CastleRAT Historical Bot Infections website IP addresses with compromised credentials per country – linear scale. Link to public Dashboard 2026-11-12)
(CastleRAT Historical Bot Infections website IP addresses with compromised credentials per country – logarithmic scale. Link to public Dashboard 2026-11-12)
Looking at the data in a different way, the tree map below shows the relative ratio of website IP addresses per country with compromised credentials associated with CastleRAT Historical Bot Infections. Unsurprisingly, many of the websites with associated compromised credentials are hosted in the United States, where many of the major Internet platforms are based:
(IP-geolocated CastleRAT Historical Bot Infections website IP addresses with compromised credentials per country. Link to public Dashboard 2026-11-12)
Data for credentials stolen by CastleRAT usually contain a URL field (the website a set of credentials is associated with), an account field for that website (which could be a user name such as “johndoe”, an email address such as “john.doe@gmail.com”, or some other identifier, such as a telephone number or numeric ID number) and a password field. Focusing only on logins with the format somestring@some.domain, which are therefore more likely to be an email address, it is clear that major email service providers are the top sources of domains for those email addresses (potentially suggesting compromised personal rather than business email addresses). There is then a very long tail with a lower number of compromised accounts per domain for a large number of different domains, including many individual business, education and government entities.
We can visualize the relative ratios of stolen credentials across users of different email services. Looking at the top 100 associated domains for those compromised email addresses (ensuring that any domains for individual non-email service provider victim organizations are labelled as REDACTED) as a treemap it is clear that the major service providers dominate:
(Top 100 CastleRAT Historical Bot Infections domains from email-like logins)
The graph below shows more detail, with counts per top 100 domain (note – there are multiple probable variations of typos of gmail included in the data, highlighting that infostealer data can often be relatively noisy and error prone – for both cyber criminal actors and data analysts):
(Top 100 CastleRAT Historical Bot Infections domains from email-like logins – logarithmic scale)
If you have any questions, please contact us, although there may be limitations on what information can be shared at this time due to the ongoing LE investigations.
This activity is another great example of the success that can be achieved in public/private partnerships when sustainable non-profit funding is available. Thank you to the UK Foreign, Commonwealth and Development Office (FCDO) and UK Integrated Security Fund (ISF) for supporting The Shadowserver Foundation’s public benefit mission in UK FY25-26, thereby partly enabling us to provide free support to our international Law Enforcement partners on another successful cyber crime disruption operation.