NewsPublished 13 Nov 2026

Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure

Source SecurityWeek

Description

Law enforcement agencies from multiple countries have disrupted the infrastructure of the Gootloader, CastleRAT, and StealC malware families as part of Operation Endgame. The takedown involved seizing 235 servers and 257 domains, and recovering 6.4 million victim credentials. Gootloader, active since at least 2018, operated as a dropper for ransomware and other malware, infecting over 25,000 computers and causing significant financial damage. CastleRAT, a remote access trojan active since 2025, enabled ransomware deployment by providing attackers control over infected machines. StealC, active since 2023, focused on stealing passwords, data, and identities. The disruption has severely crippled these malware operations and their distribution networks. The stolen credentials have been shared with multiple cybersecurity organizations to aid in victim notification and further defense efforts.

Impact

The disruption of Gootloader, CastleRAT, and StealC infrastructure has severely impacted the operators' ability to distribute malware and conduct cybercrime activities such as ransomware deployment, data theft, and identity theft. Gootloader infected over 25,000 computers and caused nearly $29 million in damages in the US. CastleRAT enabled remote control of infected machines for ransomware attacks, with 180,000 email addresses and 893,000 unique passwords recovered. StealC focused on stealing credentials and identity data, with 6.4 million victim credentials seized. The takedown reduces the threat posed by these malware families and helps protect potential victims from further compromise.

Defensive guidance

This threat has been mitigated through law enforcement seizure of servers and domains associated with the malware operations. The stolen credentials have been shared with multiple cybersecurity organizations to assist in victim notification and remediation. Organizations and individuals should monitor notifications from HaveIBeenPwned and similar services to determine if their credentials were compromised and take appropriate actions such as changing passwords and enabling multi-factor authentication. No additional immediate action is required to mitigate the malware infrastructure itself as it has been disrupted.

References

securityweek.com/law-enforcement-disrupts-gootloader-castlerat-and-stealc-infrastructure/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 Nov 2026, 10:58 UTC

Technical details

References

Community reviews