International law enforcement disrupts StealC, Gootloader, and CastleRAT malware infrastructure
International law enforcement disrupted 235 servers and 257 domains used by StealC, Gootloader, and CastleRAT malware, identifying approximately 6.4 million stolen credentials.
Triage facts
Revision 1- Evidence
- Confirmed activeHigh confidence
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:43 UTC
- Source quality
- A1Very likely
European and international authorities, including police from Germany, the Netherlands, Britain, and the United States, conducted an operation to dismantle infrastructure linked to the StealC, Gootloader, and CastleRAT malware. Investigators traced the network to the Virtualine bulletproof hosting provider. This action follows a previous takedown of related infrastructure in June.
Impact
Law enforcement disrupted 235 servers and 257 domains. Investigators uncovered approximately 6.4 million stolen login credentials from more than 40,000 victims.
Recommendation
Individuals are encouraged to visit police-sanctioned resources such as politie.nl/checkyourhack or haveibeenpwned.com to check for potential compromise and review recommended remediation steps.
Threat Hunt
Identify outbound network connections to infrastructure associated with StealC, Gootloader, or CastleRAT, specifically focusing on traffic patterns to domains and servers identified as part of the rebuilt infrastructure after law enforcement takedowns.
Data: Network flow logs, DNS query logs, Proxy logs