[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFm90ZTt0EYuBgNm3s_SZIDyaGdcRALiH5DL2RVtyllw":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":62},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"a445392a-ad0c-47b5-85d6-236379fece27","Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure","law-enforcement-disrupts-gootloader-castlerat-and-stealc-infrastructure-a7c26c","Investigators seized 235 servers and 257 domains, along with 6.4 million victim credentials as part of Operation Endgame. The post Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure appeared first on SecurityWeek.","Law enforcement agencies from the US, Europe, Australia, and Canada have dismantled the infrastructure of Gootloader, CastleRAT, and StealC malware as part of Operation Endgame. The operation resulted in the seizure of 235 servers and 257 domains, significantly impacting the distribution networks for these cybercrime-as-a-service tools. Gootloader, active since 2018, has been linked to over 25,000 infections and $28.8 million in damages in the US. CastleRAT, active since at least 2025, provided threat actors with remote access for deploying ransomware, while StealC, active since 2023, focused on stealing credentials and data. The operation also led to the recovery of 6.4 million victim credentials.","Law enforcement seized 235 servers and 257 domains, disrupting Gootloader, CastleRAT, and StealC infrastructure.","https:\u002F\u002Fwww.securityweek.com\u002Flaw-enforcement-disrupts-gootloader-castlerat-and-stealc-infrastructure\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FGootloader-seized.webp","2026-11-13T10:48:40+00:00","2026-11-13T11:00:15.481686+00:00",8,[17,20,22,24],{"name":18,"type":19},"Gootloader","threat_actor",{"name":21,"type":19},"CastleRAT",{"name":23,"type":19},"StealC",{"name":25,"type":26},"Operation Endgame","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":27,"icon":29,"name":30,"slug":31},null,"Threat Intelligence","threat-intelligence",[33,38,43,48],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":29,"name":51,"slug":52},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[54,56,57],{"type":42,"value":18,"context":55},"Malware family disrupted in Operation Endgame.",{"type":42,"value":21,"context":55},{"type":42,"value":23,"context":55},[],{"controls":60,"vendors":61},[],[],{"slug":63,"title":64,"body":65,"framework_refs":66,"framework_notes":72},"operation-endgame-dismantles-malware-as-a-service-infrastructure-stealing-millions-of-credentials","Operation Endgame Dismantles Malware-as-a-Service Infrastructure Stealing Millions of Credentials","Operation Endgame demonstrates the scale of damage that cybercrime-as-a-service ecosystems can inflict before law enforcement intervention — Gootloader alone caused $28.8 million in damages and over 25,000 infections across six years of operation. These platforms lowered the barrier for ransomware deployment and credential theft by providing ready-made tools to any willing criminal. The recovery of 6.4 million victim credentials underscores how widespread the downstream harm becomes when such infrastructure is allowed to operate unchecked. Organizations that fell victim often lacked the detection controls needed to identify early-stage infections before ransomware was deployed or credentials were exfiltrated.",[67,68,69,70,71],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1539: Steal Web Session Cookie","CIS Control 17: Incident Response Management (v8)","NIST CSF 2.0 DE.CM: Continuous Monitoring","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":73,"MITRE ATT&CK T1566: Phishing":74,"NIST CSF 2.0 DE.CM: Continuous Monitoring":75,"MITRE ATT&CK T1539: Steal Web Session Cookie":76,"CIS Control 17: Incident Response Management (v8)":77},"NIS2 requires entities to have incident handling capabilities; the prolonged, large-scale operation of these malware platforms against EU-connected victims indicates insufficient detection and response processes were in place.","Gootloader commonly spreads via SEO poisoning and malicious document downloads, a delivery mechanism this technique covers, and detecting it early would have limited the 25,000+ infections.","Continuous monitoring of endpoints and network traffic for loader and RAT behaviour would have surfaced Gootloader and CastleRAT activity earlier, limiting ransomware deployment opportunities.","StealC is designed to harvest credentials and session data from victims, directly matching this technique, and MFA enforcement would have reduced the value of the 6.4 million stolen credentials.","The scale of infections and credential theft highlights that many victim organizations lacked mature incident response plans to detect and contain these threats before significant damage occurred."]