CastleRAT

Europol and Partners Seize 257 Domains and 235 Servers in Major Operation Endgame Strike Against Gootloader, CastleRAT, and StealC

Europol and law enforcement agencies from nine countries have dismantled key infrastructure belonging to the Gootloader, CastleRAT, and StealC malware operations as part of Operation Endgame. The coordinated action resulted in the seizure of 257 domains and 235 servers while identifying 6.4 million victim datasets stolen from infected systems. Gootloader has been active since 2020 as a malware loader, StealC functions as an infostealer targeting credentials and cryptocurrency wallets, and CastleRAT is a remote access trojan first observed last year. Authorities noted that the stolen credentials were being sold for use in further attacks including ransomware deployments. Victim data will be shared through platforms such as HaveIBeenPwned to notify affected users, with specific advice issued to WordPress administrators. This marks the latest phase in a series of Operation Endgame actions that previously disrupted SocGholish, Amadey, Rhadamanthys, and multiple other malware families.