MeridianMeridian

Europol and Partners Seize 257 Domains and 235 Servers in Major Operation Endgame Strike Against Gootloader, CastleRAT, and StealC

Europol and law enforcement agencies from nine countries have dismantled key infrastructure belonging to the Gootloader, CastleRAT, and StealC malware operations as part of Operation Endgame. The coordinated action resulted in the seizure of 257 domains and 235 servers while identifying 6.4 million victim datasets stolen from infected systems. Gootloader has been active since 2020 as a malware loader, StealC functions as an infostealer targeting credentials and cryptocurrency wallets, and CastleRAT is a remote access trojan first observed last year. Authorities noted that the stolen credentials were being sold for use in further attacks including ransomware deployments. Victim data will be shared through platforms such as HaveIBeenPwned to notify affected users, with specific advice issued to WordPress administrators. This marks the latest phase in a series of Operation Endgame actions that previously disrupted SocGholish, Amadey, Rhadamanthys, and multiple other malware families.

BleepingComputerTranslated from English

Read at source

Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations.

Gootloader is a malware loader active since 2020, StealC is an infostealer that helps exfiltrate credentials, cryptocurrency wallets, and other sensitive information from victims' devices, and CastleRAT is a remote access trojan that surfaced last year. All three malware families have been used by various cybercriminal operations, including ransomware gangs.

The joint action is part of Operation Endgame, an international law enforcement effort targeting cybercrime and "cybercrime-as-a-service" networks. This stage of Operation Endgame included law enforcement agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States, with Europol and Eurojust coordinating the effort.

Together with private partners who helped identify, take down, seize, and block infrastructure tied to the three malware operations, the authorities seized 257 domains and 235 servers. They also identified 6.4 million victim datasets on the targeted criminal infrastructure, stolen from malware-infected systems for use in other cyberattacks, including ransomware breaches.

"During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week. The suspects were using these credentials, stolen from the victims after they infected them, to sell them and later be used for other cyber-attacks such as ransomware," Europol said.

"Victim data will be made available via platforms HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC, alerting victims of stolen credentials caused by the CastleRAT malware. WordPress users are urged to update credentials, enable multi-factor authentication, and patch vulnerabilities."

Previous Operation Endgame actions

In June, as part of the same operation, law enforcement agencies also cleaned nearly 15,000 malware-infected WordPress websites and seized 106 servers used by the SocGholish botnet and the Evil Corp Russian cybercrime group. Later that month, Operation Endgame disrupted malicious infrastructure used by the Amadey and StealC malware operations, taking down 326 servers and 142 domains and recovering around 27 million credentials stolen from more than 385,000 compromised systems.

One year ago, the same joint law enforcement action also took down over 1,000 servers used by the Rhadamanthys, VenomRAT, and Elysium botnet malware operations. Previously, Operation Endgame targeted Smokeloader botnet customers and servers, ransomware infrastructure, the AVCheck site, and various other major malware operations, including DanaBot, IcedID, Pikabot, Trickbot, Smokeloader, Bumblebee, and SystemBC.

StealCGootLoaderCastleRATOperation EndgameHaveIBeenPwnedSocGholishEvil Corp
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Malware & Botnets

186 TypoSquatted AI Domains Deliver ClickFix Lures, Net Guard Malware, and Search Hijacking Extensions
Malware & Botnets

186 TypoSquatted AI Domains Deliver ClickFix Lures, Net Guard Malware, and Search Hijacking Extensions

Cybersecurity researchers at Island have identified a large-scale campaign using 186 lookalike domains that impersonate popular AI tools from 27 brands. The operation, named TypoPrompting, routes visitors to ClickFix-style social engineering pages, the Net Guard browser hijacker, or malicious Chrome extensions that override search providers. Domains mimicking Anthropic Claude, OpenAI ChatGPT, Google Gemini, Microsoft Copilot, and others have been active since at least July 2023. One path leads through fingerprinting scripts to fake Cloudflare verification pages that execute PowerShell commands, while another delivers the Net Guard MSIX package capable of injecting JavaScript and altering browser settings. A third vector promotes 16 extensions, including Quick Search, that collectively claim nearly one million users and redirect queries to third-party services.

The Hacker NewsNov 12, 2026Translated from English

Threat Actors Deploy SCKit Malware Toolkit Through Compromised ConnectWise ScreenConnect Panels
Malware & Botnets

Threat Actors Deploy SCKit Malware Toolkit Through Compromised ConnectWise ScreenConnect Panels

A threat actor compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers in a coordinated campaign reported by Huntress. The attacks began on November 11 when unauthorized access to cloud-hosted ScreenConnect panels was used to execute commands on managed endpoints. At least six managed service providers and 288 hosts across 48 organizations were affected, with all compromised hosts hit within a 90-minute window. Attackers deployed rogue ScreenConnect clients along with the SCKit malware toolkit, which establishes persistent backdoor access, intercepts session cookies, and attempts self-replication by infecting technician workstations. The campaign exploited an authentication flaw in the third-party RMM+ extension for ScreenConnect versions 1.0.31 and 1.0.32, where an unconfigured access key defaulted to blank. ConnectWise responded by disabling five related extensions across approximately 400 environments, and both Huntress and ConnectWise released indicators of compromise.

SecurityWeekNov 12, 2026Translated from English

Threat Actors Abuse Legitimate GSocket Tool for Stealthy Persistent Access on Linux Servers
Malware & Botnets

Threat Actors Abuse Legitimate GSocket Tool for Stealthy Persistent Access on Linux Servers

Multiple threat actors have been observed abusing the open-source GSocket remote access tool to maintain long-term access to compromised Linux servers, even after initial vulnerabilities are patched. The tool enables attackers to bypass firewalls and NAT by routing traffic through the Global Socket Relay Network, where both the compromised host and the attacker initiate outbound connections. Microsoft Defender for Endpoint telemetry recorded a 356.2% increase in GSocket-related detections between March and August, with 87.1% of incidents targeting web applications and hosting environments. Attackers disguise GSocket as kernel threads and establish persistence via cron jobs, systemd services, and shell startup files. In some cases, they attempted to exploit the Dirty Frag Linux kernel vulnerability CVE-2026-43284 to escalate privileges. Most affected organizations belong to the education, research, technology, manufacturing, and government sectors. Defenders are advised to remove GSocket artifacts, restrict outbound traffic, and audit persistence mechanisms.

BleepingComputerNov 12, 2026Translated from English