Europol Strikes Malware Networks

Europol and international partners have dismantled infrastructure linked to the Gootloader, CastleRAT and StealC malware networks, seizing 235 servers and 257 domains in the latest phase of Operation Endgame. Authorities said more than 6.4 million stolen victim credentials were identified and secured during the operation.

Gootloader, a malware loader distributed through compromised websites and fake legal documents, was linked to ransomware and other criminal activity. Authorities took down 14 servers and 218 domains and remediated 681 infected websites.

The operation also targeted CastleRAT, a remote-access trojan used to control compromised computers and facilitate data theft and ransomware attacks. Officials seized 120 servers and 39 domains. StealC, a malware tool designed to extract passwords, access credentials and digital identities, was linked to the dismantling of a further 102 servers.

Europol said victim information will be shared through platforms including Have I Been Pwned, the Dutch Institute for Vulnerability Disclosure and the Shadowserver Foundation. The agency urged WordPress users to update passwords, enable multifactor authentication and patch known vulnerabilities. The coordinated effort involved law enforcement and private-sector partners from Europe, North America and Moldova, with support from Europol’s European Cybercrime Centre and Eurojust.