International law-enforcement agencies have dismantled infrastructure supporting the Gootloader, CastleRAT and StealC malware operations, seizing 235 servers and 257 domains and securing approximately 6.4 million stolen victim datasets. Europol said the action was carried out with partners in nine countries as part of the latest phase of Operation Endgame. Europol’s announcement describes the operation as an effort to disrupt the criminal services underpinning malware distribution and credential theft. [16]
The seizure strikes three different links in the cybercrime supply chain. Gootloader acted as a loader and botnet, commonly reaching victims through compromised WordPress sites and deceptive downloads before providing access that could be sold to ransomware operators. CastleRAT is a remote-access trojan that gives attackers control of infected systems, while StealC is an information stealer designed to extract passwords, stored credentials and digital identities for resale or fraudulent use.
The Netherlands police said the operation removed 14 Gootloader servers, confiscated 218 associated domains and disinfected 681 compromised websites. Authorities also dismantled 120 CastleRAT servers and 39 domains, along with 102 StealC servers. The infrastructure takedown does not by itself prove that every infected endpoint has been cleaned, but seizure banners, victim notifications and remediation work are intended to reduce continued abuse. Dutch police published its country-level figures. [10]
The credential haul illustrates the downstream risk for defenders. Germany’s Federal Criminal Police Office attributed more than 6.4 million stolen logins to over 40,000 victims, data that criminals could reuse for account takeover, network intrusion and follow-on extortion. Security partners have begun processing and sharing the recovered data to support victim notification and password resets, according to reporting on the operation. [11]
Gootloader’s impact is particularly documented in the United States. The U.S. Department of Justice said the malware had infected at least 25,000 computers worldwide since 2018 and was used in ransomware attacks against at least 44 U.S. victims, producing approximately $28.8 million in losses. The agency said its operation removed Gootloader from more than 100 servers, including compromised WordPress sites, and seized U.S. domains used to deliver and control the malware. [1]
Organizations should treat the disruption as a trigger for defensive checks rather than evidence that the threat has ended. Administrators should review endpoint and identity telemetry for infostealer activity, reset credentials exposed on affected systems, revoke active sessions and tokens, enforce multifactor authentication, and inspect remote-access and cloud-account logs for suspicious reuse. Users should avoid unexpected document downloads and report infections through their organization’s incident-response process; law-enforcement infrastructure seizures can interrupt criminal operations, but they cannot undo credentials already copied or sold.
References
- Gootloader Malware Disrupted in International Cyber Operation
- International action disables cybercriminal network
- Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure
- 6.4 million victim datasets secured in international operation against malware networks – Gootloader, CastleRAT, and StealC malware targeted in latest Operation ENDGAME cyber strike
