Police seize 257 domains and 235 servers tied to Gootloader, CastleRAT and StealC
Europol and agencies from nine countries took part in Operation Endgame. Authorities identified 6.4 million victim datasets and will share them through HaveIBeenPwned and other services.
Law enforcement agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK and the US worked with Europol to seize 257 domains and 235 servers linked to the Gootloader, CastleRAT and StealC malware operations, BleepingComputer reported. Europol and Eurojust coordinated the operation, called Operation Endgame, according to the same report.
Gootloader has been active since 2020 as a loader for other malware. StealC is an infostealer that takes credentials, cryptocurrency wallets and other sensitive data. CastleRAT, a remote access trojan, appeared last year, BleepingComputer reported. All three have been used by cybercriminal operations, including ransomware gangs, the report added.
Private-sector partners helped identify, seize and block the infrastructure, and authorities identified 6.4 million victim datasets on the seized systems, BleepingComputer reported. Europol described those records as stolen from infected machines and as data that could be sold or reused for attacks such as ransomware, according to the same report.
BleepingComputer reported that Europol said "over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week." The data will be shared through HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC so people can check whether CastleRAT exposed their credentials, according to Europol. Authorities urged WordPress administrators to change their credentials, turn on multi-factor authentication and install security patches, BleepingComputer reported.
The 420.in reported that Gootloader was distributed through hacked WordPress sites that showed fake legal documents to trick visitors into downloading malicious files. Authorities took down 14 servers and 218 domains linked to Gootloader, 120 servers and 39 domains for CastleRAT and 102 servers for StealC, the report said. It also noted that 681 hacked websites were cleaned up during the operation.
In June, law enforcement cleaned nearly 15,000 malware-infected WordPress sites and seized 106 servers used by SocGholish and Evil Corp, BleepingComputer reported. The same report said the operation later disrupted Amadey and StealC infrastructure, seizing 326 servers and 142 domains and recovering about 27 million credentials from more than 385,000 systems.
Mezha.net also noted that a year ago the same operation took down over 1,000 servers used by the Rhadamanthys, VenomRAT and Elysium botnets.
Sources: BleepingComputer, Mezha.net, The 420.in
Lena Vasquez covers vulnerabilities, breaches and identity for Five Nines. She writes from advisories, vendor bulletins and published reporting.
Corrections. Report an error to corrections@thefivenines.com. We list substantive corrections on the corrections page.