Europol and partners from nine countries, including the US, UK, Germany, the Netherlands, Canada and Poland, took down the infrastructure of three malware operations: Gootloader, a loader active since 2020 used to deliver other malware; StealC, which steals passwords, crypto wallets and sensitive data; and CastleRAT, a remote access trojan that appeared last year. All three have been used by criminal groups, including ransomware gangs. The action seized 235 servers and 257 domains.
The action is another stage of Operation Endgame, the international effort against cybercrime-as-a-service. The seized servers held 6.4 million victim datasets, and according to Europol more than 6 million stolen credentials that the criminals sold for use in further attacks.
What to do: victim data will be shared with services such as HaveIBeenPwned and Shadowserver, where people can check whether their details were exposed. Europol urges WordPress users to change passwords, enable multi-factor authentication and install updates.