Skip to content
securitytabs

LiveUpdated

Police take down servers behind Gootloader, CastleRAT and StealC malware

An international police operation seized servers and websites used to spread three kinds of password-stealing and access-selling malware. Organizations do not need to act urgently, but stolen logins from the seized data may still be in circulation.

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Europol and law enforcement partners from nine countries seized hundreds of servers and domains used by the Gootloader, CastleRAT and StealC malware operations, in an action described as part of Operation Endgame. [1][2]

SecurityWeek reports investigators seized 235 servers and 257 domains, along with 6.4 million victim credentials. [2]

What the malware did

Criminals used the three malware tools to gain access to computers, steal passwords and launch ransomware attacks, according to The Hacker News. It reports that Germany's Federal Criminal Police Office (BKA) said the seized logins belonged to more than 40,000 victims. [3]

What is not yet known

The coverage available so far does not say whether the malware tools remain usable, whether arrests were made, or how victims will be notified. [1][2][3]

Timeline

  1. Germany's BKA said the seized logins belonged to more than 40,000 victims. [3]

  2. Investigators reported 235 servers, 257 domains and 6.4 million credentials seized. [2]

  3. Europol and partners from nine countries seized servers and domains used by Gootloader, CastleRAT and StealC. [1]

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Stolen logins are central to this case, and the sources do not publish a victim-check service or indicators yet. [3]

What to do

  1. Ask your IT provider whether they have received any notice about exposed credentials linked to this operation. [3]
  2. Watch for official notifications from law enforcement about affected accounts. [1]

Mid-size company

A small IT or security team

What to know

The seized data includes 6.4 million stolen credentials, and the tools were used to launch ransomware attacks. [2][3]

What to do

  1. Check whether staff accounts could have been exposed to credential-stealing malware and review the status of those accounts. [3]
  2. Watch for law enforcement or vendor notices naming affected organizations. [1]

Large enterprise

A security operations team

What to know

Three malware families were disrupted at once, but no indicators have been published in the coverage cited here. [1][2]

What to do

  1. Review detections for Gootloader, CastleRAT and StealC activity and check for credential exposure tied to these families. [3]
  2. Follow Europol and national police announcements for indicators and victim-notification details. [1]

Sources

  1. [1]BleepingComputer · Nov 12, 15:07 UTC
    Police dismantle Gootloader, CastleRAT, StealC malware infrastructurecontext
  2. [2]SecurityWeek · Nov 13, 10:48 UTC
    Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructurecontext
  3. [3]The Hacker News · Nov 13, 10:55 UTC
    Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Loginscontext