Police dismantle Gootloader, CastleRAT, StealC malware infrastructure

Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations.

Gootloader is a malware loader active since 2020, StealC is an infostealer that helps exfiltrate credentials, cryptocurrency wallets, and other sensitive information from victims' devices, and CastleRAT is a remote access trojan that surfaced last year. All three malware families have been used by various cybercriminal operations, including ransomware gangs.

The joint action is part of Operation Endgame, an international law enforcement effort targeting cybercrime and "cybercrime-as-a-service" networks. This stage of Operation Endgame included law enforcement agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States, with Europol and Eurojust coordinating the effort.

Together with private partners who helped identify, take down, seize, and block infrastructure tied to the three malware operations, the authorities seized 257 domains and 235 servers.

They also identified 6.4 million victim datasets on the targeted criminal infrastructure, stolen from malware-infected systems for use in other cyberattacks, including ransomware breaches.

"During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week. The suspects were using these credentials, stolen from the victims after they infected them, to sell them and later be used for other cyber-attacks such as ransomware," Europol said.

"Victim data will be made available via platforms HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC, alerting victims of stolen credentials caused by the CastleRAT malware. WordPress users are urged to update credentials, enable multi-factor authentication, and patch vulnerabilities."

Previous Operation Endgame actions

In June, as part of the same operation, law enforcement agencies also cleaned nearly 15,000 malware-infected WordPress websites and seized 106 servers used by the SocGholish botnet and the Evil Corp Russian cybercrime group.

Later that month, Operation Endgame disrupted malicious infrastructure used by the Amadey and StealC malware operations, taking down 326 servers and 142 domains and recovering around 27 million credentials stolen from more than 385,000 compromised systems.

One year ago, the same joint law enforcement action also took down over 1,000 servers used by the Rhadamanthys, VenomRAT, and Elysium botnet malware operations.

Previously, Operation Endgame targeted Smokeloader botnet customers and servers, ransomware infrastructure, the AVCheck site, and various other major malware operations, including DanaBot, IcedID, Pikabot, Trickbot, Smokeloader, Bumblebee, and SystemBC.