Europol-led action seizes 257 domains and 235 servers used by Gootloader, CastleRAT and StealC

Europol and law enforcement partners from nine countries seized 257 domains and 235 servers used by the Gootloader, CastleRAT and StealC malware operations, according to BleepingComputer. The action is part of Operation Endgame, an international law enforcement effort targeting cybercrime and cybercrime-as-a-service networks. Agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States took part, with Europol and Eurojust coordinating.

The authorities also identified 6.4 million victim datasets on the targeted infrastructure, stolen from infected systems for use in other cyberattacks, including ransomware breaches. Europol said the suspects were selling the stolen credentials for use in attacks such as ransomware. Victim data will be shared through platforms including HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC so that affected users can be alerted.

Why it matters Seized credentials at this scale mean that organizations whose staff were infected by these infostealers may already have exposed accounts, so resetting passwords, enabling multi-factor authentication and checking whether affected users appear in the shared breach platforms should be treated as a priority. For investigators, the operation shows how infostealer logs and loader infrastructure feed the access that ransomware groups buy, which makes credential monitoring and takedown tracking part of the same workflow.