In a large-scale international operation known as "Operation Endgame", law enforcement agencies in the United States, Europe, Australia, and Canada have managed to seize the infrastructure of three of the most dangerous malware families: Gootloader, CastleRAT, and StealC. The operation resulted in the seizure of 235 servers and 257 domains, in addition to the recovery of 6.4 million sets of victim credentials.
These malware programs rely on the "Cybercrime-as-a-Service" model, where they are used to facilitate ransomware attacks and large-scale data theft through complex distribution networks.
Details of Targeted Malware
- Gootloader: This malware has been operating since 2018 as a dropper for other software, including ransomware. It uses compromised websites containing fake legal documents to spread its infections. According to the U.S. Department of Justice, this malware has infected more than 25,000 devices, causing approximately $28.8 million in damages in the United States. The recent operation led to the removal of the malware from 100 servers, while Europol seized 14 servers and 218 domains associated with it, along with cleaning 681 compromised websites.
- CastleRAT: This Remote Access Trojan (RAT), active since at least 2025, gives attackers full control over infected devices to use them for file encryption and ransom demands. The raids resulted in the seizure of 120 servers and 39 domains, and the recovery of data including 180,000 email addresses and 893,000 unique passwords.
- StealC: This malware functions as a data stealer and a dropper, focusing primarily on stealing passwords and identity information. 102 of its servers were disabled during this campaign.
What changes practically?
The importance of this operation lies in striking criminal "supply chains"; instead of just stopping a single piece of malware, authorities targeted the infrastructure that allows criminals to sell data and use it in subsequent attacks. Furthermore, sharing 6.4 million stolen credentials with security organizations such as HaveIBeenPwned and The Shadowserver Foundation enhances the technical community's ability to protect users and alert them before their stolen data is exploited in new ransomware attacks.