[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJNWUTb2TuKf_1XX11Mn40Os4e1lkdugSikIwGzURe1A":3},{"article":4,"iocs":53,"watch_terms":60,"solutions":61,"lesson":118},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"8b00b5ce-d97a-4152-9cf0-e68ab8fe3223","International operation dismantles malware networks, exposes 6.4 million stolen credentials","international-operation-dismantles-malware-networks-exposes-6-4-million-stolen-c-0ce015","The Operation Endgame action dismantled the loaders, remote access trojans and infostealers that give ransomware gangs their way into corporate networks. The post International operation dismantles malware networks, exposes 6.4 million stolen credentials appeared first on CyberScoop.","An international operation involving nine countries and Europol has dismantled the infrastructure behind three malware kits used in ransomware attacks and data theft. The operation, dubbed Operation Endgame, seized 235 servers and 257 domains, and identified credentials belonging to 6.4 million victims. The targeted malware kits include CastleRAT, Gootloader, and StealC, which facilitated remote access, initial access via fake documents, and credential extraction for resale.","International operation dismantles malware networks, exposing 6.4 million stolen credentials.","https:\u002F\u002Fcyberscoop.com\u002Foperation-endgame-malware-takedown-gootloader-stealc-europol\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F11\u002FScreenshot-2026-11-12-at-11.44.40-AM.png","2026-11-12T16:55:34+00:00","2026-11-12T17:00:26.95007+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"Operation Endgame","campaign",{"name":21,"type":22},"CastleRAT","product",{"name":24,"type":22},"Gootloader",{"name":26,"type":22},"StealC",{"name":28,"type":29},"Europol","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,56,58],{"type":34,"value":21,"context":55},"Remote access trojan dismantled in Operation Endgame.",{"type":34,"value":24,"context":57},"Dropper and initial access vector dismantled in Operation Endgame.",{"type":34,"value":26,"context":59},"Stealer with dropper functions dismantled in Operation Endgame.",[28,21,24],{"controls":62,"vendors":117},[63,92],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":52,"name":93,"problem":94,"products":95},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":113,"product_name":114,"url":115,"description":116},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[],{"slug":119,"title":120,"body":121,"framework_refs":122,"framework_notes":128},"64-million-credentials-stolen-via-malware-kits-targeting-unsuspecting-users","6.4 Million Credentials Stolen via Malware Kits Targeting Unsuspecting Users","Operation Endgame revealed how three malware families — CastleRAT, Gootloader, and StealC — compromised millions of victims primarily through social engineering tactics like fake documents that tricked users into executing malicious payloads. Once installed, these tools harvested credentials en masse for resale on criminal markets, demonstrating the severe downstream impact of initial-access malware. The scale of 6.4 million stolen credentials underscores how a single moment of user inattention can cascade into enterprise-wide compromise. This incident matters because stolen credentials are a primary enabler of ransomware attacks, meaning credential theft is not just a data problem — it is a ransomware precursor.",[123,124,125,126,127],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1555: Credentials from Password Stores","CIS Control 14: Security Awareness and Skills Training (v8)","NIS2 Article 21(2)(j)","NIST SP 800-53 IA-5: Authenticator Management",{"NIS2 Article 21(2)(j)":129,"MITRE ATT&CK T1566: Phishing":130,"NIST SP 800-53 IA-5: Authenticator Management":131,"MITRE ATT&CK T1555: Credentials from Password Stores":132,"CIS Control 14: Security Awareness and Skills Training (v8)":133},"Mandating multi-factor authentication would have rendered the 6.4 million stolen credentials significantly less useful to attackers attempting to monetise them.","Gootloader gains initial access by luring users into opening fake documents, which is a phishing-based delivery technique this control addresses.","This control requires organisations to protect authenticators and enforce credential hygiene, which would limit the impact of mass credential harvesting by malware like StealC.","StealC is specifically designed to extract stored credentials from browsers and applications, the exact behaviour this technique describes.","Training users to recognise fake documents and unsolicited file lures would have reduced the initial infection rate of Gootloader across victims."]