Operation Endgame disrupted hundreds of systems — a StealC backend I reported still exposes its known routes
Source Reddit Malware
Discussion
Operation Endgame was a coordinated takedown that disrupted hundreds of malicious servers and domains associated with malware campaigns including StealC. Despite the takedown, a previously reported StealC backend infrastructure still responds on its known malware-specific API routes, returning HTTP 405 status codes, indicating the routes remain registered and reachable. However, this does not confirm that the full malware functionality, such as payload delivery or data exfiltration, remains operational. The monitoring was intermittent and showed some outages, so continuous availability is not confirmed. The takedown successfully removed GitHub typosquat repositories used for delivery, but the backend infrastructure outside GitHub remains partially accessible. This highlights that large-scale takedowns can disrupt many systems while some components may persist in a limited or dormant state.
r/Malware (opens in a new tab)u/oliver-zehentleitner0 points0 comments
In April, I documented a StealC v2 campaign distributed through 19 GitHub typosquat repositories, including one impersonating my own open-source project.
The delivery chain was:
text GitHub typosquat -> Python dropper -> api.nailproxy.space -> encrypted Windows loader -> StealC v2 DLL -> spellmarketplace.club / 62.60.226.113:6673
GitHub later removed all 19 repositories.
The backend infrastructure remained a separate problem. I reported the domains, IP, malware routes, and hashes to the relevant registrars, Cloudflare, the hosting provider, CERT-Bund, GitHub Security Lab, ThreatFox, and AlienVault OTX.
Then Operation Endgame disrupted infrastructure associated with SocGholish, Amadey, and StealC. Europol reported 326 servers and 142 domains actioned. Microsoft separately said it moved against more than 200 malicious Amadey and StealC C2 domains and IPs.
Three months after my original disclosure, I checked the known infrastructure again using only minimal unauthenticated GET and HEAD requests.
The documented malware-specific routes still behave differently from an arbitrary control path:
text GET /api/v1/auth/session -> 405 Method Not Allowed GET /api/v1/data/sync -> 405 Method Not Allowed GET /foo/bar/baz -> 404 Not Found
HEAD returns the same status codes for all three paths.
This does not prove that payload delivery, authentication, or exfiltration still works. I deliberately did not send the HMAC handshake, trigger Stage 2, or interact with the malware protocol.
It does show that the known application routes remain registered and reachable.
The evidence also has limitations:
- The monitoring cron produced only 18 measurements over 69 days.
- There were gaps of up to 20 days.
- The endpoints briefly became unreachable in late May.
- GET and HEAD return different status codes on the root paths of
spellmarketplace.cluband the bare IP, so I do not treat those checks as proof that the complete backend is operational.
The point is not that Operation Endgame failed. It clearly disrupted a large amount of criminal infrastructure.
The narrower lesson is that both of these statements can be true:
Hundreds of malicious systems were disrupted.
A specific previously reported backend still exposes its documented malware routes.
Full technical write-up, including the original kill chain, abuse-report timeline, ThreatFox/OTX submissions, current probe results, and evidence limitations:
https://blog.technopathy.club/operation-endgame-stealc-backend-still-responds
I would be interested in how other analysts verify whether previously reported C2 infrastructure was actually included in a large takedown without actively engaging the malware protocol.