Gootloader is a malware loader active since 2020, StealC is an infostealer that helps exfiltrate credentials, cryptocurrency wallets, and other sensitive information from victims' devices, and CastleRAT is a remote access trojan that surfaced last year. All three malware families have been used by various cybercriminal operations, including ransomware gangs. The joint action is part of Operation Endgame, an international law enforcement effort targeting cybercrime and "cybercrime-as-a-service" networks.
This stage of Operation Endgame included law enforcement agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States, with Europol and Eurojust coordinating the effort. Together with private partners who helped identify, take down, seize, and block infrastructure tied to the three malware operations, the authorities seized 257 domains and 235 servers. They also identified 6.4 million victim datasets on the targeted criminal infrastructure, stolen from malware-infected systems for use in other cyberattacks, including ransomware breaches. "During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week.
