Ethical Hacking News
Operation Endgame: A Global Effort to Take Down Gootloader, CastleRAT, and StealC Malware Syndicate
A recent police operation, codenamed Operation Endgame, took down servers behind the Gootloader, CastleRAT, and StealC malware syndicate, seizing 6.4 million stolen logins and removing malware from 681 hacked websites. The operation was the result of an international police collaboration aimed at disrupting the activities of the notorious malware syndicate. The syndicate's tools were used to gain access to computers, steal passwords, and launch ransomware attacks. The operation highlights the importance of international cooperation in the fight against cybercrime and the need for individuals and organizations to take steps to protect themselves from malware and other cyber threats.
International police collaboration disrupted the activities of a notorious malware syndicate codenamed Operation Endgame.Gootloader, CastleRAT, and StealC malware tools were taken down, infecting at least 25,000 computers worldwide.The operation resulted in the seizure of 6.4 million stolen logins and removal of malware from 681 hacked websites.Police collaboration with Europol and other agencies helped disrupt the malware syndicate's activities.The operation highlights the importance of international cooperation in combating cybercrime and the need for better cybersecurity measures.
The recent takedown of Gootloader, CastleRAT, and StealC servers marks a significant milestone in the ongoing battle against cybercrime. The operation, codenamed Operation Endgame, was the result of an international police collaboration that aimed to disrupt the activities of a notorious malware syndicate.
Gootloader, CastleRAT, and StealC are three malware tools that have been used by cybercriminals to gain access to computers, steal passwords, and launch ransomware attacks. The Gootloader malware, in particular, has been used to spread other malware, including ransomware, through fake legal documents placed on hacked websites, often WordPress sites. The syndicate's operators used search engine optimization (SEO) poisoning to push these sites high in search results, making it easier for them to infect new computers.
According to the U.S. Justice Department, Gootloader has infected at least 25,000 computers worldwide since 2018. The malware was used in ransomware attacks against at least 44 victims, resulting in about $28.8 million in losses. German police reported a much higher count of infected computers, stating that Gootloader has infected millions of computers worldwide since its first appearance in 2020.
CastleRAT, a remote access trojan (RAT) known since 2025, allows attackers to control an infected computer remotely. The police seized 120 of its servers and 39 domains. StealC, an infostealer that exfiltrates passwords and other login credentials from infected computers, allowing criminals to sell or misuse them, was also taken down. The operation marked the second time this year that StealC's operators were targeted.
Police also seized about 6.4 million stolen logins belonging to more than 40,000 victims. The stolen logins were obtained from various sources, including the three malware tools. The German Federal Criminal Police Office (BKA) reported that the stolen logins were used to gain access to computers and steal sensitive information.
The operation was the result of an international police collaboration that aimed to disrupt the activities of the malware syndicate. The police operation was supported by Europol, and involved the removal of Gootloader from more than 100 servers, including hacked WordPress sites. The operation also involved the seizure of U.S. domains used to deliver and control the malware.
In addition to the seizure of malware servers and domains, police also removed malware from 681 hacked websites. The Dutch National Special Crime Unit (NSK) helped clean the websites, and officers removed the attackers' code and access, leaving a message for the site owners with advice on securing their sites.
The police operation was part of a broader effort to combat cybercrime and protect the rights of individuals and organizations. The operation highlights the importance of international cooperation in the fight against cybercrime and the need for individuals and organizations to take steps to protect themselves from malware and other cyber threats.
The operation also underscores the need for better cybersecurity measures, such as multi-factor authentication, to prevent the spread of malware and protect sensitive information. The police operation demonstrates that law enforcement agencies are committed to combating cybercrime and protecting the public.
In conclusion, the recent takedown of Gootloader, CastleRAT, and StealC servers marks a significant milestone in the ongoing battle against cybercrime. The operation highlights the importance of international cooperation and the need for individuals and organizations to take steps to protect themselves from malware and other cyber threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Operation-Endgame-A-Global-Effort-to-Take-Down-Gootloader-CastleRAT-and-StealC-Malware-Syndicate-ehn.shtml
https://thehackernews.com/2026/11/operation-endgame-takes-down-gootloader.html
https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
https://www.acronis.com/en/tru/threat-catalog/malware/infostealers/stealc/
Published: Fri Nov 13 07:21:54 2026 by llama3.2 3B Q4_K_M
