Media Coverage

Europol, alongside global partners, has dismantled the criminal infrastructure behind Gootloader, CastleRAT, and StealC malware. In coordinated actions, law enforcement seized 235 servers and 257 domains, severely crippling these malware distribution networks. During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week. The suspects were using these credentials, stolen from the victims after they infected them, to sell them and later be used for other cyber-attacks such as ransomware.

Victim data will be made available via platforms HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC, alerting victims of stolen credentials caused by the CastleRAT malware. WordPress users are urged to update credentials, enable multi-factor authentication, and patch vulnerabilities. Europol’s European Cybercrime Centre (EC3) provided critical support, including cyber intelligence, financial tracing, and victim notifications. This operation is part of Operation Endgame, the largest-ever international effort against ransomware enablers, with over 30 public and private partners. Eurojust supported judicial authorities in exchanging information and synchronising actions.

The Department of Justice today announced the successful removal of malware known as “Gootloader” from over 100 computer servers, including compromised WordPress sites, and the seizure of U.S. domain names used by criminals to deliver and control the Gootloader malware. Since 2018, Gootloader malware has infected at least 25,000 computers around the world. Gootloader malware has been used in ransomware attacks of at least 44 U.S. based victims which has resulted in approximately $28.8 million in loss.

In addition to the law enforcement seizures, the Shadowserver Foundation assisted by working with internet service providers and Computer Security Incident Response Teams (CSIRTs) to identify infected systems, aid in notifying victims and assisting in remediation. These actions were conducted in coordination with Operation Endgame, a multinational law enforcement initiative targeting the dismantling of malware cybercriminal services. More information regarding Operation Endgame can be found at www.operation-endgame.com.

TRM Labs has launched the Disruption Awards, celebrating the people and partnerships disrupting crime together. Each award honors a coalition of two or more organizations that led to an impactful disruption. This year’s winners reflect the principle behind the awards: the most effective disruptions happen when law enforcement and private companies share intelligence and act on it together.

The Blackout, which recognizes the removal or disabling of criminal infrastructure at scale, was awarded to the coalition that disrupted Tycoon 2FA, a phishing-as-a-service platform that by mid-2025 accounted for about 62% of the phishing attempts Microsoft blocked. On March 4, 2026, acting under a U.S. court order and in coordination with Europol, Microsoft’s Digital Crimes Unit seized 330 domains used to run the service, while partners contributed threat intelligence, traced stolen funds, and notified more than 200 national computer emergency response teams. The coalition includes Europol, Microsoft, SpyCloud, Coinbase, the Shadowserver Foundation, Intel 471, and Trend Micro and multiple other law enforcement agencies throughout Europe.

Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. On Friday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers have begun exploiting the flaw in the wild and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog, ordering federal agencies to secure their servers by Sunday. Although GitLab released patches three weeks ago, threat watchdog Shadowserver revealed over the weekend that it tracks more than 1,000 unpatched GitLab servers exposed to ongoing attacks. GitLab says its DevSecOps platform has over 70 million registered users and is used by more than 50% of Fortune 100 companies worldwide.

The Hacker News disclosed that Dutch security firm Eye Security intervened to disable a dangerous background updater found in the abandoned software Time4Popcorn. The updater, which lacked encryption and verification, allowed for remote code execution at the highest privilege levels on Windows and Mac systems. Eye Security discovered the flaw when a client laptop attempted to connect to an expired web address. By registering the domain, the firm identified millions of vulnerable devices globally, including those on government and corporate networks. The firm has since transferred control of the domains to the Shadowserver Foundation to ensure ongoing protection.

Days after a cyberattack targeting French supermarket refrigerators, thousands of controllers across the globe are visible online and at risk of compromise. Hackers were able to manipulate controls inside the refrigerators, causing systems to overheat – and in some cases catch fire – leading to millions of dollars in damage. About 350 instances of the Danfoss AK-SM 800A remained exposed as of Wednesday, down from more than 550 earlier this week, according to researchers from Shadowserver Foundation. On Thursday, researchers said 1,173 Copeland XWEB Pro and Evo instances remain exposed to the internet.

Brooklyn District Attorney Eric Gonzalez announced today that, in one of the biggest operational cyber disruptions undertaken by a local prosecutor’s office, his Virtual Currency Unit (VCU) successfully disrupted a multinational cryptocurrency fraud operation that targeted members of the Russian community in the U.S.  The law enforcement cyber action disabled the global scam operation, seizing and disrupting 241 web domains and 112 servers, the contents of which confirmed the millions of dollars lost by the Russian community in Brooklyn, and throughout the country. The District Attorney thanked the FBI, Shadowserver, Coeus, and UltaHost for their assistance and cooperation in the investigation.

The Dutch National Police, the Netherlands Public Prosecutor’s Office, and the Shadowserver Foundation have taken down a malicious proxy service consisting of 178,000 compromised devices. Through the proxy service, criminals were able to exploit the IP addresses of innocent citizens and businesses. Users who try to visit the proxy service’s site will get to see a splash page that says that “this website has been taken down” by the Dutch National Police, the Netherlands Public Prosecutor’s Office, and the Shadowserver Foundation, a nonprofit security organization that helps to make the internet more secure for everyone.

SonicWall has released hotfixes to address a maximum-severity server-side request forgery (SSRF) flaw in SMA1000 series appliances (tracked as CVE-2026-102255). Internet security threat watchdog Shadowserver currently tracks over 400 Internet-exposed SMA1000 appliances, although some may have already been patched. Although CVE-2026-102255 is not exploited in the wild, attackers often target SMA1000 flaws because they affect enterprise-grade secure remote access gateways used by government agencies, Managed Service Providers (MSSPs), and many large corporations to provide VPN access to internal apps and corporate networks.

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities. Citrix released security updates to address the flaws (tracked as CVE-2026-88771 and CVE-2026-88772) days after national cybersecurity agencies, IT suppliers, and security teams began privately contacting Citrix customers and advising them to shut down their NetScaler appliances. Currently, threat watchdog Shadowserver tracks over 23,000 IP addresses with NetScaler fingerprints exposed on the Internet (including nearly 22,000 NetScaler ADC appliances and just over 1,500 Gateway instances).