hacker-news Nov 13, 2026 · Crawled Nov 14, 2026

Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins

1 IoCs 3 Malware

AI Summary

Operation Endgame, an international law enforcement effort, dismantled infrastructure associated with Gootloader, CastleRAT, and StealC—three malware tools used in cybercrime operations. Gootloader, a loader malware, spread via SEO-poisoned fake legal documents on compromised WordPress sites, enabling ransomware attacks and credential theft. CastleRAT is a remote access trojan allowing full control over infected systems, while StealC is an infostealer that exfiltrates login credentials. Authorities seized 235 servers and 257 domains across the three campaigns, along with 6.4 million stolen credentials, though no arrests were announced. The takedown included disruption of bulletproof hosting provider Virtualine/Omegatech, which supported StealC's infrastructure.

AI-extracted · verify before operational use

Extracted Entities 3 found

Malware GootLoader → Malware NightshadeC2 (Windows) → Malware Stealc →

Indicators of Compromise 1 extracted

Type	Value	Detail
Domain	Virtualine/Omegatech	Details →

MITRE ATT&CK TTPs 10 techniques

T1059.001 PowerShell · Execution T1059.005 Visual Basic · Execution T1071.001 Web Protocols · Command And Control T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1106 Native API · Execution T1136 Create Account · Persistence T1170 T1170 T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1204.002 Malicious File · Execution