Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
Law enforcement dismantled Gootloader, CastleRAT, and StealC malware infrastructure.
Europol and law enforcement from nine countries dismantled the infrastructure of Gootloader, CastleRAT, and StealC malware operations as part of Operation Endgame. The operation seized 257 domains and 235 servers, identifying over 6.4 million stolen victim datasets. Gootloader is a malware loader, StealC is an infostealer, and CastleRAT is a remote access trojan, all used in various cybercriminal operations including ransomware.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Europol?
Get an email when a new story names Europol, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonLaw enforcement from ten countries coordinated to seize 257 domains and 235 servers supporting Gootloader, CastleRAT, and StealC malware ecosystems, uncovering over 6.4 million stolen victim datasets. These malware families form a layered criminal toolkit: Gootloader delivers initial access, StealC exfiltrates credentials and sensitive data, and CastleRAT provides persistent remote control — often culminating in ransomware deployment. The sheer scale of stolen data underscores how long these operations ran undetected across victim environments. This incident highlights that organizations must actively detect and respond to initial-access malware like Gootloader before it enables further-stage attacks, as delayed detection dramatically amplifies the damage.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Gootloader
- malware — CastleRAT
- malware — StealC
- malware — SocGholish
- malware — Amadey
- malware — Rhadamanthys
- malware — VenomRAT
- malware — Elysium
- malware — Smokeloader
- malware — DanaBot
- malware — IcedID
- malware — Pikabot
- malware — Trickbot
- malware — Bumblebee
- malware — SystemBC