Europol Takes Down 235 Servers and 257 Domains Linked to Gootloader, CastleRAT, and StealC Malware
Europol disrupts Gootloader, CastleRAT, and StealC malware infrastructure, taking down 235 servers and 257 domains.
Europol and international partners have disrupted infrastructure linked to Gootloader, CastleRAT, and StealC malware services as part of Operation Endgame. The operation took down 235 servers and 257 domains, recovering 6.4 million victim datasets and targeting the cybercrime-as-a-service model. Gootloader used fake legal documents and search poisoning, CastleRAT provided remote control, and StealC targeted credentials, with their combined infrastructure removal disrupting multiple stages of cyberattacks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Europol?
Get an email when a new story names Europol, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGootloader exploited users' trust by poisoning search engine results with fake legal documents, tricking victims into downloading malware — a technique that succeeds primarily because users lack awareness of search-based delivery threats. Once installed, the combined toolset of CastleRAT and StealC enabled remote control and credential theft at scale, demonstrating how modular cybercrime-as-a-service platforms amplify the impact of a single successful infection. The recovery of 6.4 million victim datasets underscores how broadly these campaigns spread before detection and takedown. Organizations that failed to block malicious domains, detect unusual outbound connections, or train users on evaluating downloads from search results were disproportionately affected.
What helps against this
How we list vendors- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Gootloader
- malware — CastleRAT
- malware — StealC