bleeping-computer Nov 12, 2026 · Crawled Nov 13, 2026

Police dismantle Gootloader, CastleRAT, StealC malware infrastructure

2 IoCs 1 Actors 12 Malware

AI Summary

Law enforcement agencies from nine countries, coordinated by Europol and Eurojust, dismantled infrastructure associated with the Gootloader, CastleRAT, and StealC malware operations as part of Operation Endgame. The operation resulted in the seizure of 257 domains and 235 servers used by these cybercriminal networks. Authorities identified over 6.4 million stolen victim datasets, including more than 6 million credentials, which were exfiltrated by the malware and intended for use in follow-on attacks such as ransomware. Victims' data will be shared with cybersecurity organizations to enable alerts and remediation, particularly urging WordPress users to update credentials and enable multi-factor authentication.

AI-extracted · verify before operational use

Extracted Entities 13 found

Malware GootLoader → Malware NightshadeC2 (Windows) → Malware Stealc → Malware FAKEUPDATES → Threat Actor Evil Corp → Malware Amadey → Malware Rhadamanthys → Malware SmokeLoader → Malware DanaBot → Malware IcedID → Malware Pikabot → Malware TrickBot → Malware BumbleBee →

Indicators of Compromise 2 extracted

Type	Value	Detail
Domain	AVCheck	Details →
Domain	SCKit	Details →

MITRE ATT&CK TTPs 22 techniques

T1059.001 PowerShell · Execution T1059.005 Visual Basic · Execution T1071.001 Web Protocols · Command And Control T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1106 Native API · Execution T1136 Create Account · Persistence T1170 T1170 T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1204.002 Malicious File · Execution T1027 Obfuscated Files or Information · Defense Evasion T1036 Masquerading · Defense Evasion T1055 Process Injection · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1071 Application Layer Protocol · Command And Control T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1204 User Execution · Execution T1486 Data Encrypted for Impact · Impact T1001.003 Protocol or Service Impersonation · Command And Control T1053.005 Scheduled Task · Execution T1071.004 DNS · Command And Control