Europol said law-enforcement agencies and private-sector partners disrupted infrastructure used by Gootloader, CastleRAT and StealC during the latest Operation Endgame action announced on November 12.
The Dutch police reported taking down 14 servers, seizing 218 domains and disinfecting 681 websites linked to Gootloader. They also said 120 servers and 39 domains tied to CastleRAT were dismantled, along with 102 servers used by the StealC infostealer. The Dutch police said the operation secured more than 6.4 million stolen personal data items. Authorities from Germany, Denmark, the United Kingdom, the United States and Canada supported the action, with Europol and Eurojust, according to the Dutch police statement.
Gootloader spread through compromised websites and malicious search results, often using fake legal documents to infect visitors and deliver additional malware, including ransomware. The Dutch police said criminals compromised WordPress websites so they would appear near the top of search results and redirect visitors to malware sites. The FBI has also warned about fake online document-converter sites used to spread malware, including Gootloader variants. CastleRAT is a remote access trojan that gives attackers control of infected computers, while StealC is an infostealer designed to collect passwords, stored access data and digital identities.
The Dutch police said stolen information included usernames, passwords, cryptocurrency wallets and system details. Data stolen by CastleRAT is being made available through the police Check Your Hack portal and shared with services including the Shadowserver Foundation, Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks and NL-NCSC. The latest action follows earlier disruptions, including an October 27 operation against the Amadey malware controller that cut off about 180,000 infected computers.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
