Operation Endgame dismantles CastleRAT, Gootloader and StealC networks
Original title: International operation dismantles malware networks, exposes 6.4 million stolen credentials
Authorities seized 235 servers and 257 domains and identified credentials for 6.4 million victims.
Police in nine countries, with Europol and Eurojust, dismantled infrastructure behind CastleRAT, Gootloader and StealC under Operation Endgame. The kits provided remote access, ransomware initial access and stolen credentials offered for further attacks. Authorities seized 235 servers and 257 domains. Victim data will be shared through Have I Been Pwned, Shadowserver and the Dutch National Cyber Security Centre.
- CastleRAT seizures covered 120 servers and 39 domains.
- Gootloader takedown included 14 servers, 218 domains and 681 cleaned websites.
- Investigators dismantled 102 StealC servers after June 2026 seizures.
- Nine countries joined more than 30 public and private partners.
- Seized systems held more than 6 million credential sets offered for sale.
Impact: 6.4 million stolen credential sets collected for resale and ransomware
- 1.WordPress users should update credentials, enable multi-factor authentication and patch vulnerabilities.
- 2.Check Have I Been Pwned, Shadowserver or the Dutch NCSC for exposed credentials.
From the original article
3 min read at cyberscoop.com
The Operation Endgame action dismantled the loaders, remote access trojans and infostealers that give ransomware gangs their way into corporate networks. The post International operation dismantles malware networks, exposes 6. 4 million stolen credentials appeared first on CyberScoop.
By Greg Otto · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.