In a coordinated global effort, law enforcement agencies have successfully dismantled servers operated by cybercriminals utilizing Gootloader, CastleRAT, and StealC malware. This operation, executed earlier this week, aimed to thwart the criminal use of these tools to infiltrate computers, swipe passwords, and execute ransomware attacks.
During the operation, authorities confiscated approximately 6.4 million stolen login credentials affecting over 40,000 individuals, as reported by Germany’s Federal Criminal Police Office (BKA). This significant seizure marks a major step in combating cybercrime on a large scale.
Understanding the Threat from Gootloader
Gootloader functions as a malware loader that infiltrates systems by downloading additional malicious software, predominantly ransomware. The cybercriminals utilized deceptive legal documents on compromised websites, particularly WordPress sites, and engaged in SEO poisoning to elevate these sites’ search rankings, increasing their reach.
Since its emergence in 2018, Gootloader has reportedly compromised at least 25,000 computers globally, according to the U.S. Justice Department. The malware operators leveraged these infected systems to further propagate infections and sell access to ransomware attackers, leading to substantial financial losses in the U.S.
German authorities provided a broader perspective, indicating millions of infections worldwide since 2020. As part of the operation, 14 Gootloader servers and 218 domains were shut down, and malware was eradicated from 681 hacked websites.
Crackdown on CastleRAT and StealC
CastleRAT, known since 2025 as a remote access trojan, facilitates unauthorized control over compromised computers. Law enforcement agencies seized 120 of its servers and 39 domains during the operation, curbing its reach and impact significantly.
StealC, an infostealer designed to extract passwords and login credentials, was also targeted. Despite previous efforts to dismantle its infrastructure, operators attempted to rebuild and evade law enforcement. This week’s actions led to the disruption of key infrastructure and the shutdown of a bulletproof hosting service associated with the malware.
Protective Measures for Victims and Website Owners
Efforts to protect affected individuals and organizations are ongoing. Dutch police have introduced a service called Check your hack, which allows users to verify if their data has been compromised by CastleRAT. Additional data will be integrated into the service in the coming weeks, providing continued support to potential victims.
Authorities emphasize that emails purporting to offer verification links are fraudulent. Genuine communications from police will not include such links. The Shadowserver Foundation is working alongside internet service providers and response teams to locate infected systems and alert their owners.
In Denmark, the National Special Crime Unit (NSK) has collaborated on cleaning infected websites. Recommendations for securing WordPress sites include changing administrator passwords, enabling multi-factor authentication, removing unfamiliar accounts, and updating site components.
This international operation underscores the ongoing commitment to dismantling cybercriminal networks and protecting users from malicious activities. Continued vigilance and adherence to security best practices remain crucial in safeguarding digital environments.
