International police have disrupted infrastructure used by Gootloader, CastleRAT and StealC in a new phase of Operation Endgame. More than 6.4 million stolen personal data items were secured, according to a November 12 announcement from Dutch police. That figure describes recovered data, not a count of individual victims.
The Gootloader action removed 14 servers and 218 domains, while partners cleaned 681 compromised websites. Police said the attackers abused WordPress sites and search rankings to draw people toward malware infections that could lead to ransomware.
CastleRAT, which gives attackers remote control of infected computers, lost 120 servers and 39 domains. Authorities also reported taking down 102 StealC servers while monitoring renewed activity following an earlier operation in June. StealC targets information such as passwords and other saved credentials.
For potential victims, recovered data creates an opportunity to identify exposure. Police said CastleRAT records are available through their Check Your Hack service, with more information due in the coming weeks. Victim data is also being shared with notification partners including Have I Been Pwned and the Shadowserver Foundation.
