Summary
- Operation Endgame targeted Gootloader, CastleRAT, and StealC infrastructure.
- Authorities acted against 235 servers and 257 domains and identified millions of stolen credentials.
- Recovered data will support victim notification and further investigations.
Europol and international partners have disrupted three malware networks, acting against 235 servers and 257 domains while recovering approximately 6.4 million victim datasets.
Europol confirmed on 12 November that coordinated international action against Gootloader, CastleRAT and StealC had resulted in measures against 235 servers and 257 domains. Investigators also identified approximately 6.4 million sets of stolen victim credentials within the criminal infrastructure.
The operation forms part of Operation Endgame, an international initiative targeting the technical services that support ransomware and other financially motivated cybercrime. Rather than concentrating exclusively on individual attackers, participating authorities have sought to dismantle the infrastructure used to deliver malicious software, maintain access to compromised systems and distribute stolen information.
Three services with different criminal functions
Gootloader operated as a malware delivery mechanism, exploiting searches for apparently legitimate legal documents to direct users towards malicious downloads. Compromised websites, including WordPress installations, were used to distribute the files. Once executed, the malware could establish an initial foothold from which further intrusions or ransomware deployment might follow.
Authorities reported action against 14 servers and 218 domains associated with Gootloader, alongside remediation of 681 infected websites. The website component is particularly relevant to organisations whose legitimate online presence may have been used to facilitate attacks against unrelated victims.
CastleRAT served a different purpose. The remote access trojan allowed attackers to control compromised computers and could support subsequent malicious activity. Europol described the malware as flexible and difficult to detect, with its use linked to serious organisational disruption and extortion. Authorities seized 120 servers and 39 domains associated with the operation.
StealC was primarily used to extract credentials and other sensitive information from infected devices. Such information can be traded, combined with other datasets or used in subsequent attempts to access corporate accounts. The operation involved action against 102 StealC servers, extending earlier disruption efforts undertaken in June.
Stolen credentials retain value after takedowns
Although infrastructure seizures can interrupt malware distribution and command-and-control operations, they do not automatically eliminate the consequences of earlier infections. Credentials collected before the disruption may remain usable wherever passwords have not been changed, authentication sessions remain valid or compromised identities retain access to business services.
The authorities intend to make recovered victim information available through established notification organisations, including Have I Been Pwned, the Shadowserver Foundation and national cybersecurity partners. This creates an opportunity to identify exposure that affected users and organisations may not otherwise have detected.
The criminal service model also complicates attribution and remediation. A loader operator, malware developer, credential broker and ransomware group may each participate in different stages of an intrusion. Disrupting one service can constrain several downstream activities without necessarily identifying every organisation that ultimately exploited the stolen access.
Organisations investigating possible exposure must establish whether credentials were extracted, additional malware was installed, or unauthorised access continued after the initial infection. Recovered credential records are not proof that every associated account was compromised, but can provide evidence for reviewing authentication activity and initiating proportionate containment.
The operation involved police and investigative agencies from European countries, the United Kingdom, Canada and the United States, supported by Europol and Eurojust. Its cross-border structure reflects the difficulty of tackling malware services whose operators, infrastructure, customers and victims may be located in different jurisdictions.
Europol’s European Cybercrime Centre supported the operation through intelligence coordination, financial tracing and victim notification. Further investigative work will determine how much of the disrupted infrastructure can be attributed to identifiable individuals and how effectively recovered information can reach affected organisations.
