[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFEIcyCee7inxYpMIvMMs34ABHj7dCKOQFjbssGI0qQA":3},{"article":4,"iocs":49,"watch_terms":86,"solutions":87,"lesson":90},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"4f353b83-f83f-4e19-a624-0bf24a70f7d1","Police dismantle Gootloader, CastleRAT, StealC malware infrastructure","police-dismantle-gootloader-castlerat-stealc-malware-infrastructure-438aee","Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations. [...]","Europol and law enforcement from nine countries dismantled the infrastructure of Gootloader, CastleRAT, and StealC malware operations as part of Operation Endgame. The operation seized 257 domains and 235 servers, identifying over 6.4 million stolen victim datasets. Gootloader is a malware loader, StealC is an infostealer, and CastleRAT is a remote access trojan, all used in various cybercriminal operations including ransomware.","Law enforcement dismantled Gootloader, CastleRAT, and StealC malware infrastructure.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fpolice-dismantles-gootloader-castlerat-stealc-malware-infrastructure\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F12\u002FOperation-Endgame.jpg","2026-11-12T15:07:20+00:00","2026-11-12T16:00:15.34455+00:00",8,[17,20,23],{"name":18,"type":19},"Europol","vendor",{"name":21,"type":22},"Operation Endgame","campaign",{"name":24,"type":25},"Evil Corp","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53,56,59,62,65,67,69,72,74,76,78,80,82,84],{"type":30,"value":51,"context":52},"Gootloader","Malware loader operation targeted in law enforcement action.",{"type":30,"value":54,"context":55},"CastleRAT","Remote access trojan operation targeted in law enforcement action.",{"type":30,"value":57,"context":58},"StealC","Infostealer operation targeted in law enforcement action.",{"type":30,"value":60,"context":61},"SocGholish","Botnet targeted in a previous stage of Operation Endgame.",{"type":30,"value":63,"context":64},"Amadey","Malware operation targeted in a previous stage of Operation Endgame.",{"type":30,"value":66,"context":64},"Rhadamanthys",{"type":30,"value":68,"context":64},"VenomRAT",{"type":30,"value":70,"context":71},"Elysium","Botnet malware operation targeted in a previous stage of Operation Endgame.",{"type":30,"value":73,"context":61},"Smokeloader",{"type":30,"value":75,"context":64},"DanaBot",{"type":30,"value":77,"context":64},"IcedID",{"type":30,"value":79,"context":64},"Pikabot",{"type":30,"value":81,"context":64},"Trickbot",{"type":30,"value":83,"context":64},"Bumblebee",{"type":30,"value":85,"context":64},"SystemBC",[18],{"controls":88,"vendors":89},[],[],{"slug":91,"title":92,"body":93,"framework_refs":94,"framework_notes":100},"operation-endgame-dismantles-multi-malware-infrastructure-stealing-millions-of-records","Operation Endgame Dismantles Multi-Malware Infrastructure Stealing Millions of Records","Law enforcement from ten countries coordinated to seize 257 domains and 235 servers supporting Gootloader, CastleRAT, and StealC malware ecosystems, uncovering over 6.4 million stolen victim datasets. These malware families form a layered criminal toolkit: Gootloader delivers initial access, StealC exfiltrates credentials and sensitive data, and CastleRAT provides persistent remote control — often culminating in ransomware deployment. The sheer scale of stolen data underscores how long these operations ran undetected across victim environments. This incident highlights that organizations must actively detect and respond to initial-access malware like Gootloader before it enables further-stage attacks, as delayed detection dramatically amplifies the damage.",[95,96,97,98,99],"MITRE ATT&CK T1189: Drive-by Compromise","MITRE ATT&CK T1041: Exfiltration Over C2 Channel","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events","CIS Control 13: Network Monitoring and Defense","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":101,"MITRE ATT&CK T1189: Drive-by Compromise":102,"CIS Control 13: Network Monitoring and Defense":103,"MITRE ATT&CK T1041: Exfiltration Over C2 Channel":104,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":105},"This incident involved large-scale malware operations affecting many victims; NIS2's incident handling requirements would obligate operators to have detection and response capabilities that limit dwell time and data theft at this scale.","Gootloader commonly infects victims through SEO-poisoned websites that trick users into downloading malicious files, matching this technique's description of adversaries compromising systems via web browsing.","Actively monitoring network traffic for indicators of malware command-and-control communications is precisely what this control requires and would have accelerated detection of these malware families.","StealC exfiltrates stolen credentials and datasets over its command-and-control channel, the exact behaviour this technique describes, resulting in 6.4 million victim records being harvested.","Continuous network monitoring for anomalous outbound connections would have provided earlier detection of Gootloader, CastleRAT, and StealC communicating with attacker-controlled infrastructure."]