Operation Endgame seizes servers in malware network crackdown

International law enforcement has taken action against the Gootloader, CastleRAT and StealC malware networks, seizing thousands of servers and tens of thousands of domains, and removing malware from hundreds of hacked sites. The operation, described by Europol and coordinated with U.S. agencies, resulted in the seizure of 235 servers and 257 domains across the three toolsets, and the removal of malware from 681 hacked WordPress sites.

German police, citing the ongoing investigation, placed the overall reach of Gootloader’s activity in the millions of infected computers since 2020, with U.S. authorities noting ransomware targets and losses tied to the loader and its operation. The joint action forms part of Operation Endgame, a multinational crackdown on malware networks used to access victims’ machines and exfiltrate data for criminal resale or ransom.

Victims and site owners are being alerted through multiple channels. Dutch police said they have uploaded data stolen by CastleRAT to Check your hack, a service that can notify individuals if their email addresses appear in the data, while data is being shared with Have I Been Pwned and the Shadowserver Foundation. Danish and Dutch authorities urged WordPress site owners to strengthen credentials, enable MFA, remove unknown accounts, patch WordPress ecosystems, and limit wp-admin access to trusted IPs.

The Dutch and Danish cases emphasise stolen passwords supplied through criminal channels as a vector for backdoors, with authorities continuing to notify and assist affected users and organisations. No arrests were announced in the latest action.