A massive international operation has dismantled key infrastructure behind three malware kits, exposing over 6.4 million stolen credentials and crippling the ability of cybercriminals to launch ransomware attacks and data theft operations. The takedown, known as Operation Endgame, involved law enforcement agencies from nine countries, private sector partners, and targeted the “cybercrime-as-a-service” market where malware toolkits are built, sold, and rented to other attackers.
The operation focused on three specific malware kits: CastleRAT, Gootloader, and StealC. CastleRAT is a remote access trojan that allows attackers to take control of infected computers from anywhere in the world. To evade detection, it had developed sophisticated anti-detection mechanisms, but authorities were able to seize 120 servers and 39 domains linked to the tool. The dismantling of Gootloader was also significant, as it served as a initial access vector for ransomware attacks. Police took down 14 servers and 218 domains connected to the kit and cleaned up 681 infected websites.
Gootloader’s modus operandi involved spreading fake legal documents on hacked WordPress sites, which were designed to look legitimate but actually contained malware that could infect visitors’ computers. The stolen data was then used for further attacks, including ransomware. StealC, another malware tool, was designed to extract passwords, data, and credentials from compromised machines for resale and fraudulent use. Authorities dismantled 102 servers tied to it.
The seized infrastructure held more than 6 million sets of victim credentials, which were collected by the suspects after infecting victims’ computers and offered for sale on dark web marketplaces. This means that millions of people who have had their data stolen may now find out about it and take steps to protect themselves. To help with this process, authorities will be making the compromised data available through various platforms, including HaveIBeenPwned, the Shadowserver Foundation, and the Dutch National Cyber Security Centre.
The takedown is a significant blow to the cybercrime ecosystem and marks one of the largest international efforts against ransomware enablers. It’s also a reminder that law enforcement agencies and private sector partners are working together to take down these operations and protect people from cyber threats. As for individuals, it’s essential to stay vigilant and keep their credentials secure by updating passwords regularly, enabling multi-factor authentication, and patching vulnerabilities in software.
This operation is a testament to the importance of international cooperation in tackling cybercrime. By sharing intelligence and coordinating efforts, law enforcement agencies can make a significant impact on disrupting these operations and protecting people from harm. As we move forward, it’s crucial for individuals to remain aware of the risks and take proactive steps to protect themselves and their data.
Source: CyberScoop — 2026-11-12