International
The Morning Dev

Only the news worth knowing

‹
 
B48/100

Malware · high

Operation Endgame takedown of Gootloader, CastleRAT and StealC

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Computers infected by Gootloader, CastleRAT and StealC malware, about 25,000 reported

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Full takeover · Secrets exposed

The Brief

  • Operation Endgame, an international police operation, took down servers behind the Gootloader, CastleRAT and StealC malware tools.
  • Investigators seized 235 servers and 257 domains, and about 6.4 million stolen logins.
  • The U.S. Department of Justice says Gootloader was used in at least 44 ransomware attacks costing $29 million since 2018.

Why it matters

These malware families were used to gain access to computers, steal passwords and launch ransomware, so credentials and systems they touched may still need review even after the servers were taken down.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsJudgment: infostealers and loaders compromise Windows workstations and developer credentials that IT and dev teams are responsible for.
NoCore infrastructureJudgment: malware families targeting workstations are not core infrastructure software that nearly every team runs.
NoPopular toolJudgment: these are criminal malware strains, not a widely used framework, tool, platform or package.
YesExploited in the wildThe Record: DOJ says Gootloader was used in at least 44 ransomware attacks since 2018.
NoPublic exploitSources describe takedowns and seizures; none say exploit code or a proof-of-concept was published.
NoRemote, no loginSources describe malware infections on victim computers; none describe unauthenticated network exploitation.
YesFull takeoverThe Hacker News: criminals used the tools to gain access to computers and launch ransomware attacks.
YesSecrets exposedThe Hacker News: police seized about 6.4 million stolen logins; tools were used to steal passwords.
NoSupply chainSources do not say malicious code was shipped through a developer-trusted channel such as a package or update.
NoNo fix yetThis is a criminal malware campaign and infrastructure takedown, not an unpatched vulnerability.

Timeline

  1. Help Net Security

    Operation Endgame malware takedown turns up over 6 million stolen logins

  2. BleepingComputer

    Police dismantle Gootloader, CastleRAT, StealC malware infrastructure

  3. CyberScoop

    International operation dismantles malware networks, exposes 6.4 million stolen credentials

  4. Law enforcement disruption of Gootloader, CastleRAT and StealC infrastructure announced

  5. SecurityWeek

    Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure

  6. The Hacker News

    Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins

  7. Security Affairs

    Gootloader Malware Disrupted After Infecting 25,000 Computers

  8. The Record from Recorded Future News

    DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018

Full coverage · 7 sources

First seen · 7 sources · Full story page · How tiers are decided