Police seize Gootloader, CastleRAT and StealC infrastructure
Original title: Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure
Europol says 235 servers and 257 domains were seized, and millions of stolen credentials were shared for victim notification.
Agencies in the United States, Europe, Australia and Canada seized infrastructure used by Gootloader, CastleRAT and StealC, Europol said, as part of Operation Endgame. The malware was sold as cybercrime-as-a-service and supported ransomware, remote control and credential theft. Investigators seized servers and domains, cleaned compromised sites, and passed recovered victim credentials to Have I Been Pwned and other partners.
Unconfirmed: The Justice Department cites Gootloader removal from 100 servers, while Europol reports 14 Gootloader servers seized.
- The US Justice Department says Gootloader infected over 25,000 computers and caused about $28.8 million in US damage.
- Europol reports 14 Gootloader servers and 218 domains seized, and 681 infected websites cleaned.
- CastleRAT seizures covered 120 servers and 39 domains, plus 180,000 emails and 893,000 passwords.
- Authorities disrupted 102 StealC servers and seized 6.4 million victim credentials.
Impact: ransomware delivery, remote control and stolen credentials
- 1.Check Have I Been Pwned for credentials recovered from CastleRAT and StealC.
- Malware
- GootloaderCastleRATStealC
- Organizations
- EuropolUS Department of JusticeHaveIBeenPwned
- Countries
- United StatesAustraliaCanada
From the original article
2 min read at securityweek.com
Investigators seized 235 servers and 257 domains, along with 6. 4 million victim credentials as part of Operation Endgame. The post Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.