International Police Operation Takes Down Gootloader, CastleRAT and StealC Infrastructure, Seizes 6.4M Stolen Credentials
An international law enforcement operation known as Operation Endgame successfully dismantled critical infrastructure behind three major malware tools: Gootloader, CastleRAT, and StealC. These malware families were used to gain unauthorized access to computers, steal login credentials, and facilitate ransomware attacks, affecting millions globally. Authorities seized approximately 6.4 million stolen logins from over 40,000 victims and took down 235 servers and 257 domains linked to these malware operations. Gootloader distributed malware through SEO-poisoned hacked websites, primarily WordPress sites, and infected millions of computers worldwide since 2020, leading to significant financial losses, especially in the United States. CastleRAT enabled remote control of infected systems, while StealC acted as an infostealer exfiltrating passwords for criminal misuse. The takedown included the removal of malicious code from 681 hacked websites and disruption of a bulletproof hosting service used by criminals. While no arrests were announced yet, police have implemented services for victims to check for compromises and receive remediation guidance. Authorities emphasize sustained vigilance, patching, and strong security hygiene, particularly for WordPress site administrators, as these measures can mitigate future risks.
Linha do tempo
-
International Police Operation Takes Down Gootloader, CastleRAT and StealC Infrastructure, Seizes 6.4M Stolen Credentials
ler a análise desta fonte ocultar
An international law enforcement operation known as Operation Endgame successfully dismantled critical infrastructure behind three major malware tools: Gootloader, CastleRAT, and StealC. These malware families were used to gain unauthorized access to computers, steal login credentials, and facilitate ransomware attacks, affecting millions globally. Authorities seized approximately 6.4 million stolen logins from over 40,000 victims and took down 235 servers and 257 domains linked to these malware operations. Gootloader distributed malware through SEO-poisoned hacked websites, primarily WordPress sites, and infected millions of computers worldwide since 2020, leading to significant financial losses, especially in the United States. CastleRAT enabled remote control of infected systems, while StealC acted as an infostealer exfiltrating passwords for criminal misuse. The takedown included the removal of malicious code from 681 hacked websites and disruption of a bulletproof hosting service used by criminals. While no arrests were announced yet, police have implemented services for victims to check for compromises and receive remediation guidance. Authorities emphasize sustained vigilance, patching, and strong security hygiene, particularly for WordPress site administrators, as these measures can mitigate future risks.