Law enforcement agencies in the US, Europe, Australia, and Canada have seized infrastructure behind the notorious Gootloader, CastleRAT, and StealC malware. The investigators seized 235 servers and 257 domains associated with the malicious operations, severely crippling their distribution networks, Europol says.
Operating under the cybercrime-as-a-service model, Gootloader, CastleRAT, and StealC enabled ransomware attacks, data theft, and other cybercrime activities. Distributed through compromised websites containing fake legal documents, Gootloader has been operating as a dropper for other malware families, including ransomware. Active since at least 2018, Gootloader has infected over 25,000 computers and caused damages of approximately $28.8 million in the US, the US Department of Justice says.
According to the DoJ, the fresh disruption, part of Operation Endgame, led to the dropper’s removal from 100 servers. Europol reports that 14 servers and 218 domains associated with Gootloader were seized and 681 infected websites were cleaned up.
A remote access trojan (RAT) active since at least 2025, CastleRAT has provided threat actors with control over infected machines, which were then abused to deploy file-encrypting ransomware. Law enforcement seized 120 servers and 39 domains used by CastleRAT’s operators, as well as victim data. HaveIBeenPwned says 180,000 email addresses and 893,000 unique passwords were retrieved.
Active since at least 2023, StealC functions as a stealer and a dropper, mainly focused on password, data, and identity theft. In a continuation of law enforcement action targeting the malware earlier this year, 102 StealC servers were disrupted. According to Europol, the fresh law enforcement disruption led to the seizure of 6.4 million victim credentials, which have been shared with HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC.
