Law enforcement disrupts Gootloader, CastleRAT and StealC

US and European law enforcement agencies have disrupted the infrastructure behind the Gootloader, CastleRAT and StealC malware, seizing hundreds of servers and domains and affecting millions of credentials. Investigators seized 235 servers and 257 domains linked to the operation as part of Operation Endgame, with Europol saying the disruption severely crippled the networks used to distribute malware and enable ransomware and data theft.

The DoJ has tied Gootloader to a dropper role in attacks dating back to 2018, while Europol notes 681 infected websites have been cleaned up and 14 Gootloader servers plus 218 related domains were seized in the European operation.

CastleRAT, a remote access trojan active since at least 2025, was used to control infected machines and deploy file-encrypting ransomware. Law enforcement seized 120 CastleRAT servers and 39 domains, and HaveIBeenPwned confirms 180,000 email addresses and 893,000 unique passwords were retrieved in relation to the operation. StealC, described as a stealer and dropper focusing on passwords, data and identity theft, saw 102 of its servers disrupted.

Europol states that 6.4 million victim credentials were obtained during the broader operation and subsequently shared with HaveI Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC. Europol says suspects used the credentials to sell them or enable further attacks, including ransomware.