Police seize Gootloader, CastleRAT and StealC servers and domains
Original title: Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
Authorities seized 257 domains and 235 servers and found more than 6 million stolen credentials.
Europol and agencies from nine countries seized infrastructure used by Gootloader, CastleRAT, and StealC as part of Operation Endgame. Gootloader is a loader active since 2020, StealC steals credentials and wallets, and CastleRAT is a remote access trojan; all three have been used by criminal operations, including ransomware gangs. Authorities identified 6.4 million victim datasets. Europol said more than 6 million credentials were seized and had been sold for later attacks. CastleRAT victim alerts will go out through several notification platforms, and WordPress users are urged to change credentials, enable multi-factor authentication, and patch.
- Partners included Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK, and the US.
- Private partners helped identify, seize, and block infrastructure tied to the three operations.
- Europol said suspects sold stolen credentials for later attacks, including ransomware.
- CastleRAT alerts will appear on Have I Been Pwned, DIVD, Shadowserver, and other platforms.
Impact: Stolen credentials, wallets, and millions of victim datasets
- 1.WordPress users should update credentials, enable multi-factor authentication, and patch vulnerabilities.
- Malware
- GootloaderCastleRATStealC
From the original article
2 min read at bleepingcomputer.com
Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.