Police Pull the Plug on Gootloader, CastleRAT and StealC and Recover 6.4 Million Stolen Logins. Hacked WordPress Sites Were Part of the Machine
An international Operation Endgame action seized 235 servers and 257 domains behind three malware tools used to break into computers, steal passwords and set up ransomware attacks. Police also cleaned 681 hacked websites and recovered about 6.4 million stolen logins.
For years, a familiar pattern sat behind many ransomware attacks. Someone searching for a contract template or legal form clicked a convincing result and opened a document. Without realizing it, they handed their computer to criminals who would later sell that access. This week, police in nine countries took apart a large share of the infrastructure behind that pattern.
The account below is based on The Hacker News’ report on the Operation Endgame takedown, with further details from BleepingComputer and SecurityWeek.
Three tools, one business model
The operation went after three pieces of criminal software that worked in sequence. Gootloader is a loader that gets a foothold and then downloads other malware, often ransomware. CastleRAT, which appeared last year, lets an attacker control an infected computer remotely. StealC is an infostealer that collects saved passwords and other login details so they can be sold or reused.
Gootloader relied on hacked websites, many of them running WordPress. Criminals filled those sites with fake legal documents and used search engine poisoning to push them up the results. The U.S. Justice Department says Gootloader has infected at least 25,000 computers since 2018 and was used in ransomware attacks on at least 44 U.S. victims, causing about $28.8 million in losses. German police put the global count much higher, at millions of computers, and date the malware to 2020. The difference reflects what each agency counted.
What police took down
Europol, which supported the action with Eurojust, says 235 servers and 257 domains were seized across the three operations. Agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States took part. For Gootloader alone, police took down 14 servers and 218 domains and cleaned malware off 681 hacked websites. With court approval, U.S. agencies and their partners also removed Gootloader from more than 100 servers, including compromised WordPress sites.
CastleRAT lost 120 servers and 39 domains. StealC was hit for the second time this year. German police say its operators rebuilt their infrastructure after a June action, partly on a bulletproof hosting service that was itself shut down in late October.
No arrests were announced, though Dutch police say they carried out further investigations into Gootloader’s main suspect.
Millions of logins, back in defenders’ hands
According to Germany’s Federal Criminal Police Office, investigators found about 6.4 million stolen logins belonging to more than 40,000 victims. That data is being shared with breach-notification and security services, including Have I Been Pwned and the Shadowserver Foundation. Have I Been Pwned says the CastleRAT data alone contained 180,000 email addresses and 893,000 unique passwords. Dutch police have also loaded CastleRAT data into their “Check your hack” service. Someone who enters an affected address receives an email with clean-up steps within minutes, and nothing arrives if the address is not in the data.
Police added two warnings. First, seizing a copy of the stolen data does not take it away from criminals who already have it, and as long as the malware stays on a computer it can keep stealing new passwords. Second, emails claiming to come from police and asking people to click a link to check their data are fake, because police do not send such links.
The websites were victims too
Denmark’s National Special Crime Unit helped clean the 681 sites. It believes the attackers got in with stolen passwords bought through criminal channels and then installed a backdoor. Officers removed the malicious code and left site owners a message with security advice. Danish and Dutch police recommend that WordPress owners:
- Change every administrator password to a unique one of at least 12 characters.
- Turn on multi-factor authentication.
- Delete accounts they do not recognize.
- Remove any backdoor code.
- Update WordPress and all themes and plugins.
- Limit access to the /wp-admin login page to their own devices’ IP addresses.
What this means for your company
A takedown slows these crews down, but it does not undo infections that already happened. Two practical steps follow. First, look after your people’s devices. If a staff member’s address shows up in a breach notification tied to this operation, have that computer checked for malware before changing passwords, or the new passwords may be stolen too. Then reset the affected logins and confirm multi-factor authentication is on. Second, look after your website. If your company site runs WordPress or a similar platform, the police checklist above is a solid baseline. A site quietly hosting malware hurts your visitors and your reputation even if your own network is never touched. Finally, remind staff that downloading “free” templates and forms from search results is a known infection route.
If you would like a second look at your website’s admin access or your team’s exposure to stolen-password data, we can help. Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
