Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins

Gootloader has disclosed a ransomware attack affecting its systems.

An international police operation took down servers behind Gootloader, CastleRAT and StealC this week.

Criminals used the three malware tools to gain access to computers, steal passwords, and launch ransomware attacks.

Police also seized about 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany's Federal Criminal Police Office (BKA).

Its operators used those computers to infect more computers, then sold access to the new ones to ransomware criminals.

Across the three tools, police seized 235 servers and 257 domains, according to an operation summary from Europol, which supported the action.

Anyone whose data Gootloader holds is potentially affected, not just Gootloader itself.

It spread through fake legal documents placed on hacked websites, often WordPress sites.

Criminals used SEO poisoning to push those sites high in search results.

Not having a confirmed group behind this yet doesn't make it less real -- attribution usually lags the operational impact by days or weeks.

Gootloader is a loader: once on a computer, it could download other malware, especially ransomware.

In the U.S., Gootloader was used in ransomware attacks against at least 44 victims, resulting in about $28.8 million in losses.

The attackers stole login credentials through social engineering, rather than exploiting a technical flaw.

The takedown is part of Operation Endgame, an international police campaign against malware criminals use to access victims' computers.

For Gootloader, police took down 14 servers and 218 domains and removed malware from 681 hacked websites.

Gootloader has started restoring systems and resuming operations.

Based on what investigators know so far, Gootloader has infected millions of computers worldwide since it first appeared in 2020.

After that June action, its operators changed their infrastructure and brought it back online to stay out of investigators' reach, German police said.

Review backup integrity and restoration speed now, before an incident, since recovery speed is what separates a bad week from a bad year.

Tighten help-desk identity verification and phishing-resistant authentication, since credential theft through social engineering is exactly how this attack started.

Your own incident-response and business-continuity plan is only as good as the longest outage it was actually built for, not just a short disruption.