International Law Enforcement Seizes Infrastructure Used by Gootloader, CastleRAT, and StealC Malware
Law enforcement agencies across the US, Europe, Australia, and Canada have dismantled the command and control infrastructure supporting the Gootloader, CastleRAT, and StealC malware operations. The joint operation led to the seizure of 235 servers and 257 domains, disrupting these cybercrime-as-a-service platforms known for facilitating ransomware, data theft, and other malicious activities. Gootloader, active since at least 2018, functions as a dropper distributed via compromised websites, infecting over 25,000 computers and causing approximately $28.8 million in US damages. CastleRAT, a remote access trojan in operation since 2025, provides attackers with control over infected systems to deploy ransomware, with law enforcement recovering 180,000 email addresses and 893,000 unique passwords linked to its victims. StealC, operating since at least 2023 as a stealer and dropper targeting passwords and identity data, had 102 servers disrupted, and over 6.4 million victim credentials seized, which were shared with security organizations to aid in mitigation efforts. The operation, part of “Operation Endgame,” has significantly weakened these malware campaigns and aims to prevent further criminal activities using stolen credentials.
Linha do tempo
-
International Law Enforcement Seizes Infrastructure Used by Gootloader, CastleRAT, and StealC Malware
ler a análise desta fonte ocultar
Law enforcement agencies across the US, Europe, Australia, and Canada have dismantled the command and control infrastructure supporting the Gootloader, CastleRAT, and StealC malware operations. The joint operation led to the seizure of 235 servers and 257 domains, disrupting these cybercrime-as-a-service platforms known for facilitating ransomware, data theft, and other malicious activities. Gootloader, active since at least 2018, functions as a dropper distributed via compromised websites, infecting over 25,000 computers and causing approximately $28.8 million in US damages. CastleRAT, a remote access trojan in operation since 2025, provides attackers with control over infected systems to deploy ransomware, with law enforcement recovering 180,000 email addresses and 893,000 unique passwords linked to its victims. StealC, operating since at least 2023 as a stealer and dropper targeting passwords and identity data, had 102 servers disrupted, and over 6.4 million victim credentials seized, which were shared with security organizations to aid in mitigation efforts. The operation, part of “Operation Endgame,” has significantly weakened these malware campaigns and aims to prevent further criminal activities using stolen credentials.