Europol and partners seize hundreds of servers and domains used by Gootloader, CastleRAT and StealC, investigators find 6.4 million victim datasets
Law enforcement seized malware infrastructure and found 6.4 million stolen records, creating potential for reuse of that data.
- Urgency
- L3
- 60
- 80
- 15
- 30
- 80
At a glance
Europol and law enforcement partners from nine countries seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations, and investigators identified 6.4 million victim datasets on that infrastructure. The action disrupts the targeted infrastructure and surfaced a large cache of stolen data that may be reused in other cyberattacks, including ransomware-related breaches. Organizations should prioritize checking for credential reuse, enforcing multifactor authentication, and monitoring for indicators tied to the seized infrastructure.
- Law enforcement seized malware infrastructure and found 6.4 million stolen records, creating potential for reuse of that data.
CHRONOS Wire · November 13 · Alert 2
What happened
European law enforcement seized hundreds of servers and domains used by three malware families and found a large cache of stolen data that could be reused by criminals.
Why it matters
The discovery of 6.4 million victim datasets creates potential for rapid resale or reuse of stolen data, so defenders should quickly verify exposed credentials and enforce stronger access controls.
CHRONOS Bottom Line
A coordinated multinational law enforcement action disrupted infrastructure used by Gootloader, CastleRAT, and StealC and uncovered 6.4 million victim datasets that may be available for reuse in other cyberattacks.
Full detail
What changed
Europol and law enforcement partners from nine countries seized hundreds of servers and domains used by Gootloader, CastleRAT, and StealC, and investigators identified 6.4 million victim datasets on that infrastructure.
What is genuinely new
Public reporting confirms a coordinated seizure of servers and domains used by Gootloader, CastleRAT, and StealC, and that investigators identified 6.4 million victim datasets on the targeted infrastructure.
Detailed analysis
Europol and partners executed a coordinated takedown that targeted infrastructure used by three malware families. The reporting states law enforcement seized hundreds of servers and domains and that investigators identified 6.4 million victim datasets on that infrastructure. The seizure likely disrupts those specific delivery and command infrastructure components but does not by itself eliminate the stolen datasets or prevent other criminal infrastructure from absorbing activity.
U.S. Impact
U.S. Impact assessment pending.