International Operation Endgame Disrupts Gootloader Malware Infrastructure

International law enforcement under Operation Endgame disrupted Gootloader, CastleRAT, and StealC malware infrastructure, seizing 235 servers and 257 domains used for distribution and command-and-control. Gootloader acted as an initial-access loader enabling credential theft and ransomware deployment. Authorities secured 6.4 million victim datasets and stolen logins affecting over 40,000 victims across 25,000 infected computers. U.S. authorities remediated over 100 servers and issued global victim notifications, degrading the cybercriminal ecosystem.

• Operation Overview & Scope

  • Coordinated takedown led by Europol, Germany’s BKA, U.S. DOJ, and international partners under Operation Endgame.
  • Targeted global malware distribution and C2 infrastructure supporting Gootloader, CastleRAT, and StealC.
  • Seized 235 servers and 257 domains, including U.S.-based domain names used for delivery and control.

• Malware Families & Technical Artifacts

  • Gootloader: loader malware facilitating initial access and subsequent payload deployment.
  • CastleRAT: remote access trojan associated with the disrupted infrastructure.
  • StealC: infostealer harvesting credentials and sensitive data from compromised hosts.
  • C2 infrastructure leveraged seized domains and servers for beaconing and exfiltration.

• Impact & Victim Telemetry

  • 6.4 million victim datasets and stolen logins secured by authorities.
  • Over 40,000 victims affected; 25,000+ infected computers identified.
  • Downstream threats included credential theft and ransomware deployment following initial access.

• Law Enforcement Actions & Remediation

  • U.S. authorities removed malware from over 100 servers and notified victims worldwide.
  • International cooperation enabled cross-border seizure of domains and hosting infrastructure.
  • Operation significantly degraded the cybercriminal loader ecosystem and access broker operations.

• Defensive Implications & Conclusion

  • Organizations should reset credentials for potentially exposed accounts and review C2 blocklists.
  • Hunt for Gootloader, CastleRAT, and StealC indicators across endpoints and email gateways.
  • Disruption reduces immediate threat but does not eliminate residual access or downstream ransomware actors.