# Law Enforcement Dismantles Malware Networks

A multinational law-enforcement operation dismantled infrastructure associated with the CastleRAT, Gootloader, and StealC malware networks, seizing 235 servers and 257 domains and identifying stolen credentials tied to 6.4 million victims. The operation is a cybersecurity development rather than a procurement announcement: the signal reports no solicitation or contract award, but highlights areas of continuing demand for public-sector cyber services.

- The operation involved cross-border coordination, reinforcing demand for cyber investigation and incident-response capabilities that can support international law-enforcement efforts.
- Contractors providing credential-exposure monitoring and website security services may find these capabilities relevant to agencies addressing the risks exposed by large-scale malware operations.
- The signal identifies no specific buying agency, contract vehicle, funding, or procurement timeline, so it does not establish an immediate bid opportunity.

**Jurisdictions:** international
**Industries:** Public Safety, Information Technology
**Topics:** Cybersecurity
**Published:** November 12, 2026

### Government Entities
- Europol
- Eurojust
- U.S. Department of Justice (DOJ)
- U.S. Attorney’s Office for the District of Colorado
- Dutch National Cyber Security Centre

### Key Quotes
> Cybercrime knows no borders and this case is an excellent example of international partnerships working to protect people around the world.
> — Peter McNeilly, U.S. Attorney for the District of Colorado

### Sources
- [International operation dismantles malware networks, exposes 6.4 million stolen credentials | CyberScoop](https://cyberscoop.com/operation-endgame-malware-takedown-gootloader-stealc-europol) - CyberScoop