Europol Disrupts Major Malware Networks, Seizes 6.4 Million Stolen Credentials

• •Europol seized 235 servers and 257 domains linked to Gootloader, CastleRAT, and StealC.
• •Approximately 6.4 million stolen credentials were identified and will be shared with victim notification services.
• •The operation targeted the cybercrime-as-a-service model, disrupting major malware distribution networks.

In a significant operation, Europol and law enforcement from nine countries dismantled the infrastructure behind three major malware families: Gootloader, CastleRAT, and StealC. This operation, part of Operation Endgame, resulted in the seizure of 235 servers and 257 domains. Authorities identified approximately 6.4 million sets of stolen credentials, which had been harvested from infected systems and were intended for resale or further cyberattacks, including ransomware. Gootloader, a malware loader, was primarily distributed through compromised WordPress sites, while CastleRAT allowed remote access to infected computers. StealC was designed to extract sensitive information such as passwords. The operation involved international collaboration and aimed to disrupt the cybercrime-as-a-service model. Victim data will be shared via platforms like Have I Been Pwned to alert affected individuals.