Introduction
Europol and law enforcement partners from nine countries have dismantled the Gootloader, CastleRAT, and StealC malware infrastructure, seizing hundreds of servers and domains used by cybercriminals. This operation is part of the ongoing international effort to combat cybercrime and 'cybercrime-as-a-service' networks.
Gootloader
Gootloader is a malware loader active since 2020. It is used by various cybercriminal operations, including ransomware gangs. The infrastructure used by Gootloader includes 257 domains and 235 servers.
StealC
StealC is an infostealer that helps exfiltrate sensitive information such as credentials, cryptocurrency wallets, and other data from victims' devices. The infrastructure used by StealC includes 6.4 million victim datasets and 257 domains and 235 servers.
CastleRAT
CastleRAT is a remote access trojan that surfaced last year. It is used by various cybercriminal operations, including ransomware gangs. The infrastructure used by CastleRAT includes 257 domains and 235 servers.
Joint Action
The joint action is part of Operation Endgame, an international law enforcement effort targeting cybercrime and 'cybercrime-as-a-service' networks. Law enforcement agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States, with Europol and Eurojust coordinating the effort, have taken down the infrastructure used by Gootloader, StealC, and CastleRAT.
Impact of Dismantling
The dismantling of the infrastructure used by Gootloader, StealC, and CastleRAT has resulted in the recovery of over 6 million victim credentials and the seizure of 257 domains and 235 servers. The authorities have also identified 6.4 million victim datasets on the targeted criminal infrastructure, stolen from malware-infected systems for use in other cyberattacks, including ransomware breaches. The seized infrastructure includes 257 domains and 235 servers.
Victim Data
Victim data will be made available via platforms such as HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC, alerting victims of stolen credentials caused by the CastleRAT malware. WordPress users are urged to update credentials, enable multi-factor authentication, and patch vulnerabilities.
Previous Operations
This joint action is part of the ongoing Operation Endgame, which has included previous operations targeting Smokeloader botnet customers and servers, ransomware infrastructure, the AVCheck site, and various other major malware operations, including DanaBot, IcedID, Pikabot, Trickbot, Smokeloader, Bumblebee, SystemBC, and the SocGholish botnet and the Evil Corp Russian cybercrime group.
Conclusion
Europol and international law enforcement partners have successfully dismantled the Gootloader, CastleRAT, and StealC malware infrastructure, seizing hundreds of servers and domains used by cybercriminals. This operation is part of the ongoing effort to combat cybercrime and 'cybercrime-as-a-service' networks.
Comments