Summary
Europol and Eurojust coordinated a new phase of Operation Endgame with law enforcement from nine countries, taking down infrastructure behind three malware operations that commonly give ransomware gangs their first foothold.
Participating countries: Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States.
Targets
| Malware | Type | Notes |
|---|---|---|
| Gootloader | Loader | Active since 2020 |
| StealC | Infostealer | Credential and data theft |
| CastleRAT | Remote access trojan | Emerged last year |
Results
- 257 domains and 235 servers seized, with private-sector partners helping identify, take down and block infrastructure
- 6.4 million victim datasets identified; Europol says over 6 million victim credentials were found in the criminal infrastructure
- No arrests were mentioned in the announcement
Victim data is being shared with Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC so affected people and organizations can be notified.
Context
Earlier Operation Endgame actions this year included a June cleanup of about 15,000 infected WordPress sites with 106 servers seized, and a later action against Amadey and StealC with 326 servers and 142 domains taken down and roughly 27 million credentials recovered. A year earlier, more than 1,000 servers tied to Rhadamanthys, VenomRAT and Elysium were removed.
What to Do
- Check your domains and users on Have I Been Pwned and with your national CERT notifications.
- Reset passwords and revoke sessions for any account that appears in a stealer dump, since infostealers also take browser cookies and tokens.
- Hunt for Gootloader-style delivery (poisoned search results leading to script downloads) and StealC or CastleRAT indicators in EDR.
- Takedowns are temporary; expect operators to rebuild, and keep detections in place.