[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzyDAgyQL4NDWkBve05S2XTXYY1oCig9Pq07v9bfAT_0":3},{"article":4,"iocs":47,"watch_terms":57,"solutions":58,"lesson":86},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"81630f49-207e-40a6-bffe-d77d1b997a4e","Europol Takes Down 235 Servers and 257 Domains Linked to Gootloader, CastleRAT, and StealC Malware","europol-takes-down-235-servers-and-257-domains-linked-to-gootloader-castlerat-an-11bb48","Europol and international partners have disrupted infrastructure linked to Gootloader, CastleRAT, and StealC, targeting malware services that support ransomware attacks and data theft. Announced on November 12, 2026, the latest Operation Endgame action covered 235 servers and 257 domains. Authorities also recovered 6.4 million victim datasets from criminal infrastructure. The operation targeted the cybercrime-as-a-service model, […] The post Europol Takes Down 235 Servers and 257 Domains Linked to Gootloader, CastleRAT, and StealC Malware appeared first on Cyber Security News.","Europol and international partners have disrupted infrastructure linked to Gootloader, CastleRAT, and StealC malware services as part of Operation Endgame. The operation took down 235 servers and 257 domains, recovering 6.4 million victim datasets and targeting the cybercrime-as-a-service model. Gootloader used fake legal documents and search poisoning, CastleRAT provided remote control, and StealC targeted credentials, with their combined infrastructure removal disrupting multiple stages of cyberattacks.","Europol disrupts Gootloader, CastleRAT, and StealC malware infrastructure, taking down 235 servers and 257 domains.","https:\u002F\u002Fcybersecuritynews.com\u002Fmalware-infrastructure-disrupted\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FMalware-Infrastructure-Disrupted.webp","2026-11-12T16:58:22+00:00","2026-11-12T17:00:26.169356+00:00",8,[17,20,23],{"name":18,"type":19},"Europol","vendor",{"name":21,"type":22},"Operation Endgame","campaign",{"name":24,"type":25},"WordPress","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":26,"icon":28,"name":29,"slug":30},null,"Threat Intelligence","threat-intelligence",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[48,51,54],{"type":41,"value":49,"context":50},"Gootloader","Malware service targeting victims through fake legal documents and search poisoning.",{"type":41,"value":52,"context":53},"CastleRAT","Malware providing attackers with remote control over infected computers.",{"type":41,"value":55,"context":56},"StealC","Malware targeting passwords, login details, and digital identities.",[18],{"controls":59,"vendors":85},[60],{"slug":30,"name":61,"problem":62,"products":63},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":81,"product_name":82,"url":83,"description":84},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[],{"slug":87,"title":88,"body":89,"framework_refs":90,"framework_notes":96},"search-poisoning-and-malware-as-a-service-infrastructure-dismantled-in-operation-endgame","Search Poisoning and Malware-as-a-Service Infrastructure Dismantled in Operation Endgame","Gootloader exploited users' trust by poisoning search engine results with fake legal documents, tricking victims into downloading malware — a technique that succeeds primarily because users lack awareness of search-based delivery threats. Once installed, the combined toolset of CastleRAT and StealC enabled remote control and credential theft at scale, demonstrating how modular cybercrime-as-a-service platforms amplify the impact of a single successful infection. The recovery of 6.4 million victim datasets underscores how broadly these campaigns spread before detection and takedown. Organizations that failed to block malicious domains, detect unusual outbound connections, or train users on evaluating downloads from search results were disproportionately affected.",[91,92,93,94,95],"MITRE ATT&CK T1195: Supply Chain Compromise","CIS Control 9: Email and Web Browser Protections (v8)","CIS Control 14: Security Awareness and Skills Training (v8)","NIST SP 800-53 SI-3: Malicious Code Protection","NIS2 Article 21(2)(g)",{"NIS2 Article 21(2)(g)":97,"MITRE ATT&CK T1195: Supply Chain Compromise":98,"NIST SP 800-53 SI-3: Malicious Code Protection":99,"CIS Control 9: Email and Web Browser Protections (v8)":100,"CIS Control 14: Security Awareness and Skills Training (v8)":101},"This point requires organizations to implement basic cyber hygiene and cybersecurity training, directly addressing the user-facing search-poisoning vector that Gootloader relied upon for initial compromise.","Gootloader's use of fake legal documents distributed via poisoned search results represents a form of delivery-chain manipulation that this technique covers, where adversaries compromise the path through which users obtain files.","This control mandates deploying and maintaining malicious code protection at endpoints and network entry points, which would have detected or blocked StealC and CastleRAT payloads before execution.","Implementing DNS filtering and web content controls — as this control requires — would have blocked access to the poisoned search result pages and malicious download sites used by Gootloader.","This control requires training users to recognize social engineering and malicious download tactics, which would have reduced the success rate of Gootloader's fake legal document lure."]