Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure
Law enforcement seized 235 servers and 257 domains, disrupting Gootloader, CastleRAT, and StealC infrastructure.
Law enforcement agencies from the US, Europe, Australia, and Canada have dismantled the infrastructure of Gootloader, CastleRAT, and StealC malware as part of Operation Endgame. The operation resulted in the seizure of 235 servers and 257 domains, significantly impacting the distribution networks for these cybercrime-as-a-service tools. Gootloader, active since 2018, has been linked to over 25,000 infections and $28.8 million in damages in the US. CastleRAT, active since at least 2025, provided threat actors with remote access for deploying ransomware, while StealC, active since 2023, focused on stealing credentials and data. The operation also led to the recovery of 6.4 million victim credentials.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonOperation Endgame demonstrates the scale of damage that cybercrime-as-a-service ecosystems can inflict before law enforcement intervention — Gootloader alone caused $28.8 million in damages and over 25,000 infections across six years of operation. These platforms lowered the barrier for ransomware deployment and credential theft by providing ready-made tools to any willing criminal. The recovery of 6.4 million victim credentials underscores how widespread the downstream harm becomes when such infrastructure is allowed to operate unchecked. Organizations that fell victim often lacked the detection controls needed to identify early-stage infections before ransomware was deployed or credentials were exfiltrated.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Gootloader
- malware — CastleRAT
- malware — StealC