Bulgaria's organised crime police (GDBOP) took part in ENDGAME, an international operation in which police from nine countries took down the servers and domains of three types of malware: Gootloader, CastleRAT and StealC. The Interior Ministry and Europol said Europol and Eurojust coordinated the action.
Police seized a total of 235 servers and 257 domains. They found that the cybercriminals held data on more than 6 million victims. Investigators say the suspects sold the data and used it for new cyber attacks.
ENDGAME targets the systems that other crimes depend on, such as data theft and ransomware attacks, in which files are locked until a ransom is paid. The statement says it is the largest international operation so far against such systems.
Gootloader gives hackers unauthorised access to computer systems. It spreads fake documents through WordPress sites, and anyone who downloads them infects their own computer. The stolen data is then used for blackmail. In the Gootloader case, police shut down 14 servers and 218 domains, and 681 infected websites were cleaned.
The CastleRAT trojan has been known since 2025. It gives remote access to infected computers. This lets criminals encrypt data, shut down whole IT systems or demand ransom from firms and organisations. Police seized 120 servers and 39 domains linked to CastleRAT.
StealC steals passwords, saved login details and digital identities from infected computers, and the data is then sold illegally. Police began taking down its servers in June 2026, and more than 10 have been dismantled.
Europol said anyone infected with CastleRAT can check whether their login details were stolen on HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC.
Europol advises WordPress users to change their passwords, turn on two-factor authentication and install the security updates they need to fix vulnerabilities.