Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure
Law enforcement agencies in the US, Europe, Australia, and Canada have seized the infrastructure behind the notorious Gootloader, CastleRAT, and StealC malware.
Investigators seized 235 servers and 257 domains associated with the malicious operations, severely crippling their distribution networks, Europol says.
The disruption, part of Operation Endgame, led to the dropper’s removal from 100 servers. Europol reports that 14 servers and 218 domains associated with Gootloader were seized and 681 infected websites were cleaned up.
Active since at least 2018, Gootloader has infected over 25,000 computers and caused damages of approximately $28.8 million in the US, the US Department of Justice says.
The suspects were using these credentials, stolen from the victims after they infected them, to sell them and later be used for other cyber-attacks such as ransomware.
CastleRAT and StealC Disrupted
A remote access trojan (RAT) active since at least 2025, CastleRAT has provided threat actors with control over infected machines, which were then abused to deploy file-encrypting ransomware.
Law enforcement seized 120 servers and 39 domains used by CastleRAT’s operators, as well as victim data. HaveIBeenPwned says 180,000 email addresses and 893,000 unique passwords were retrieved.
Active since at least 2023, StealC functions as a stealer and a dropper, mainly focused on password, data, and identity theft. In a continuation of law enforcement action targeting the malware earlier this year, 102 StealC servers were disrupted.
According to Europol, the fresh law enforcement disruption led to the seizure of 6.4 million victim credentials, which have been shared with HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC.
Related
