Operation Endgame Disrupts Gootloader, StealC and CastleRAT
Police took down servers for three malware families used for initial access, password theft and ransomware, seizing 6.4 million stolen logins.
⚡ Why it matters
These tools are often the first step before a ransomware attack. If your passwords were saved in the browser on a machine that was once infected, they may be in the seized data, so change them and turn on two-factor authentication.
Law enforcement agencies taking part in the international Operation Endgame have disrupted servers used by three malware families:
- Gootloader: a loader that opens the door for additional malware on infected machines.
- CastleRAT: a remote access trojan.
- StealC: an infostealer that harvests saved passwords and other data.
According to Germany's Federal Criminal Police Office (BKA), police seized about 6.4 million stolen credentials belonging to more than 40,000 victims. Criminals use these tools to gain access to devices, steal passwords and launch ransomware attacks.
Quick tips
- Don't save sensitive passwords in the browser on shared computers; use a reputable password manager.
- Turn on two-factor authentication for email, financial and work accounts.
- Be wary of search results offering free "contract templates" or documents to download, a well-known Gootloader lure.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.