In November 2026, Europol and international law enforcement partners dismantled infrastructure supporting several malware operations. Among them was CastleRAT, a remote access trojan (RAT) that enabled criminals to remotely control infected computers. Europol provided HIBP with 180k email addresses associated with CastleRAT infections, along with 893k unique passwords observed more than 3M times across accounts used on infected computers.
CastleRAT - 179,745 breached accounts
About this summary. This is a short excerpt from the description that Have I Been Pwned published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://haveibeenpwned.com/Breach/CastleRAT
Source attribution: headline and facts are from Have I Been Pwned (haveibeenpwned.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations.
6.4 million victim datasets secured in international operation against malware networks
Europol, alongside global partners, has dismantled the criminal infrastructure behind Gootloader, CastleRAT, and StealC malware. In coordinated actions, law enforcement…
Operation Endgame malware takedown turns up over 6 million stolen logins
Police in nine countries, working with Europol, took down servers behind the Gootloader, CastleRAT and StealC malware operations this week and recovered more than 6…
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
Lawrence Abrams reports: ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect…
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue…
🏴☠️ Interlock has just published a new victim : K&A Industries
K&A Industries is a "secure identity architecture" company that manages the entire authentication lifecycle for government and enterprise clients. As a result, their own…