Operation Endgame disrupted hundreds of systems — a StealC backend I reported still exposes its known routes
Operation Endgame was a coordinated takedown that disrupted hundreds of malicious servers and domains associated with malware campaigns including StealC. Despite the takedown, a previously reported StealC backend infrastructure still responds on its known malware-specific API routes, returning HTTP 405 status codes, indicating the routes remain registered and reachable. However, this does not confirm that the full malware functionality, such as payload delivery or data exfiltration, remains operational. The monitoring was intermittent and showed some outages, so continuous availability is not confirmed. The takedown successfully removed GitHub typosquat repositories used for delivery, but the backend infrastructure outside GitHub remains partially accessible. This highlights that large-scale takedowns can disrupt many systems while some components may persist in a limited or dormant state.
AI Analysis
Technical Summary
A security researcher documented a StealC v2 malware campaign that used 19 GitHub typosquat repositories to deliver a Python dropper and ultimately a StealC DLL payload. After reporting, GitHub removed the repositories, and Operation Endgame disrupted 326 servers and 142 domains linked to StealC and other malware. Despite this, minimal unauthenticated HTTP probes conducted months later showed that the known StealC backend API routes still respond with 405 Method Not Allowed status codes, distinguishing them from arbitrary paths that return 404 Not Found. These responses indicate the malware-specific routes remain registered and reachable, though no active malware protocol interaction was performed to confirm full backend functionality. Monitoring was sporadic, with some outages observed. The backend infrastructure outside GitHub remains partially accessible, underscoring that takedown operations may not completely disable all components of a malware campaign's infrastructure.
Potential Impact
The takedown disrupted a significant portion of the StealC malware infrastructure, including removal of delivery repositories and seizure of servers and domains. However, the persistence of known backend API routes suggests that some infrastructure components remain reachable, potentially allowing limited or future malicious activity if fully reactivated. The exact operational status of the backend is unknown since no authenticated or protocol-level interactions were performed. The partial availability of backend routes could pose a risk if attackers regain full control or if residual infrastructure is leveraged in other campaigns.
Mitigation Recommendations
Operation Endgame and coordinated efforts by GitHub, Europol, Microsoft, and others have already disrupted much of the StealC infrastructure, including removal of delivery repositories and seizure of servers and domains. No further immediate action is required for defenders based on the current evidence, as the backend routes' availability does not confirm active malware functionality. Continued monitoring of known indicators and collaboration with law enforcement and security communities is recommended to track any resurgence or reuse of the infrastructure.
Operation Endgame disrupted hundreds of systems — a StealC backend I reported still exposes its known routes
Description
Operation Endgame was a coordinated takedown that disrupted hundreds of malicious servers and domains associated with malware campaigns including StealC. Despite the takedown, a previously reported StealC backend infrastructure still responds on its known malware-specific API routes, returning HTTP 405 status codes, indicating the routes remain registered and reachable. However, this does not confirm that the full malware functionality, such as payload delivery or data exfiltration, remains operational. The monitoring was intermittent and showed some outages, so continuous availability is not confirmed. The takedown successfully removed GitHub typosquat repositories used for delivery, but the backend infrastructure outside GitHub remains partially accessible. This highlights that large-scale takedowns can disrupt many systems while some components may persist in a limited or dormant state.
Reddit Discussion
In April, I documented a StealC v2 campaign distributed through 19 GitHub typosquat repositories, including one impersonating my own open-source project.
The delivery chain was:
text GitHub typosquat -> Python dropper -> api.nailproxy.space -> encrypted Windows loader -> StealC v2 DLL -> spellmarketplace.club / 62.60.226.113:6673
GitHub later removed all 19 repositories.
The backend infrastructure remained a separate problem. I reported the domains, IP, malware routes, and hashes to the relevant registrars, Cloudflare, the hosting provider, CERT-Bund, GitHub Security Lab, ThreatFox, and AlienVault OTX.
Then Operation Endgame disrupted infrastructure associated with SocGholish, Amadey, and StealC. Europol reported 326 servers and 142 domains actioned. Microsoft separately said it moved against more than 200 malicious Amadey and StealC C2 domains and IPs.
Three months after my original disclosure, I checked the known infrastructure again using only minimal unauthenticated GET and HEAD requests.
The documented malware-specific routes still behave differently from an arbitrary control path:
text GET /api/v1/auth/session -> 405 Method Not Allowed GET /api/v1/data/sync -> 405 Method Not Allowed GET /foo/bar/baz -> 404 Not Found
HEAD returns the same status codes for all three paths.
This does not prove that payload delivery, authentication, or exfiltration still works. I deliberately did not send the HMAC handshake, trigger Stage 2, or interact with the malware protocol.
It does show that the known application routes remain registered and reachable.
The evidence also has limitations:
- The monitoring cron produced only 18 measurements over 69 days.
- There were gaps of up to 20 days.
- The endpoints briefly became unreachable in late May.
- GET and HEAD return different status codes on the root paths of
spellmarketplace.cluband the bare IP, so I do not treat those checks as proof that the complete backend is operational.
The point is not that Operation Endgame failed. It clearly disrupted a large amount of criminal infrastructure.
The narrower lesson is that both of these statements can be true:
Hundreds of malicious systems were disrupted.
A specific previously reported backend still exposes its documented malware routes.
Full technical write-up, including the original kill chain, abuse-report timeline, ThreatFox/OTX submissions, current probe results, and evidence limitations:
https://blog.technopathy.club/operation-endgame-stealc-backend-still-responds
I would be interested in how other analysts verify whether previously reported C2 infrastructure was actually included in a large takedown without actively engaging the malware protocol.
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A security researcher documented a StealC v2 malware campaign that used 19 GitHub typosquat repositories to deliver a Python dropper and ultimately a StealC DLL payload. After reporting, GitHub removed the repositories, and Operation Endgame disrupted 326 servers and 142 domains linked to StealC and other malware. Despite this, minimal unauthenticated HTTP probes conducted months later showed that the known StealC backend API routes still respond with 405 Method Not Allowed status codes, distinguishing them from arbitrary paths that return 404 Not Found. These responses indicate the malware-specific routes remain registered and reachable, though no active malware protocol interaction was performed to confirm full backend functionality. Monitoring was sporadic, with some outages observed. The backend infrastructure outside GitHub remains partially accessible, underscoring that takedown operations may not completely disable all components of a malware campaign's infrastructure.
Potential Impact
The takedown disrupted a significant portion of the StealC malware infrastructure, including removal of delivery repositories and seizure of servers and domains. However, the persistence of known backend API routes suggests that some infrastructure components remain reachable, potentially allowing limited or future malicious activity if fully reactivated. The exact operational status of the backend is unknown since no authenticated or protocol-level interactions were performed. The partial availability of backend routes could pose a risk if attackers regain full control or if residual infrastructure is leveraged in other campaigns.
Defensive Guidance
Operation Endgame and coordinated efforts by GitHub, Europol, Microsoft, and others have already disrupted much of the StealC infrastructure, including removal of delivery repositories and seizure of servers and domains. No further immediate action is required for defenders based on the current evidence, as the backend routes' availability does not confirm active malware functionality. Continued monitoring of known indicators and collaboration with law enforcement and security communities is recommended to track any resurgence or reuse of the infrastructure.
Technical Details
- Source Type
- Subreddit
- Malware
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":35,"reasons":["external_link","established_author","recent_news"],"isNewsworthy":true}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a6c54229c2644c7f8841bbf
Added to database: 07/31/2026, 07:52:02 UTC
Last enriched: 09/13/2026, 17:37:20 UTC
Last updated: 09/13/2026, 19:38:25 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.