German authorities on Thursday said investigators traced the rebuilt network to the Virtualine bulletproof hosting provider, seized by the FBI in October, with the assistance of police in Frankfurt and the Dutch National High Tech Crime Unit. Europol said a wider international operation this week saw law enforcement agencies and private sector partners disrupt 235 servers and 257 domains used by StealC alongside the Gootloader and CastleRAT malware.
Investigators uncovered copies of around 6.4 million stolen login credentials from more than 40,000 victims obtained by this malware. People have been encouraged to visit politie.nl/checkyourhack and haveibeenpwned.com to see if they were impacted, and to find out what to do if they were.
No arrests, cryptocurrency seizures or criminal charges accompanied the action. The authorities and Microsoft previously announced in June they dismantled hundreds of servers and domains linked to StealC and other malware tools.
