Operation Endgame – RCMP And International Partners Take Action On Cybercriminal Networks

BC — Over the last week Canada (RCMP) along with Denmark (Politi), the Netherlands (Dutch National Police), the United States (FBI and Defence Criminal Investigative Service), Germany (BKA – Federal Criminal Police Office) and the United Kingdom (National Crime Agency) have cracked down on an international cybercrime network called Gootloader.The RCMP Federal Policing Pacific Region (FPPR) Cybercrime Investigation Team – Vancouver (CIT-V) is the lead Canadian police agency and national representative participating in an international joint forces operation (JFO) targeting initial access malware, dubbed Operation Endgame. The CIT-V contributed coders, analysts and investigators to the international project.

The Russia-based Gootloader malware enables unauthorized access to computer systems around the world through compromised websites. Gootloader used infected WordPress websites to spread malware masquerading as legal documents.

During the investigation CIT-V and the RCMP Cyber and Technical Investigation Service (CTIS) developed a tool that removes Gootloader malware from infected machines. The tool was shared with Operation Endgame partners to disrupt the malware on a global scale.

Investigators from CIT-V were at Europol Headquarters in The Hague, Netherlands during the week of November 9, 2026, to participate in a global action week. During action week, the disinfection tool was deployed by law enforcement agencies in Canada, Denmark, The Netherlands and the United States. During the action against Gootloader, approximately 672 infected websites were remediated globally. In Canada, CIT-V disinfected 24 of these compromised machines.

“The dedication of law enforcement professionals worldwide, along with sustained international cooperation, is essential in combatting cyber threats that transcend all borders. Through the sharing of intelligence, expertise and investigative tools, our international partnerships are not only strong but growing stronger. I am very proud of the work that has been done by investigators, including our CIT-V team members,” said FPPR Cyber and Financial Investigation Teams Superintendent James Laton.

Operation Endgame is the largest ongoing cybercrime JFO bringing together law enforcement agencies from several countries, including Bulgaria, Canada, Denmark, Germany, Netherlands, Poland, United Kingdom and United States, supported by Europol and Eurojust.

For more information on the RCMP’s involvement in Operation Endgame, see previous media release from June 2026 (Operation Endgame—RCMP join international partners in crackdown of Russian cybercriminal network | Royal Canadian Mounted Police)

And for more detailed information on this week’s operation by our European partners, please see the news release from Europol (6.4 million victim datasets secured in international operation against malware networks – Gootloader, CastleRAT, and StealC malware targeted in latest Operation ENDGAME cyber strike | Europol)