# Operation Endgame dismantles Gootloader, CastleRAT, StealC

Published: 2026-11-12 · Severity: routine
Canonical: https://vorant.io/reports/ea5d49ef-747c-56d0-8000-e1879c4a7564/operation-endgame-dismantles-gootloader-castlerat-stealc
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Law enforcement seized 235 servers and 257 domains in Operation Endgame, disrupting Gootloader, CastleRAT, and StealC malware and securing 6.4 million victim credentials.

Source: europol.europa.eu — https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks

## What to check

- Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

Europol, alongside law enforcement from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK, and the US, conducted a coordinated takedown as part of Operation Endgame targeting three malware families used in cybercrime-as-a-service models: Gootloader, CastleRAT, and StealC. The operation seized 235 servers and 257 domains in total, remediated 681 infected websites, and identified over 6.4 million victim credentials/datasets held in the seized criminal infrastructure.

Gootloader is a dropper/loader that infected victims via fake legal documents distributed through compromised WordPress sites, often leading to follow-on ransomware deployment; 14 servers and 218 domains tied to it were taken down. CastleRAT, a remote access trojan first observed in 2025, enabled remote control of infected machines and was linked to data encryption and ransom extortion incidents; 120 servers and 39 domains were seized. StealC, an infostealer with dropper functionality used to harvest passwords and digital identities for resale, had 102 servers dismantled, continuing enforcement action that began in prior phases of the operation.

Victim credential data will be distributed via HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, Shadowserver, and NL-NCSC to notify affected individuals and organisations. Defenders, particularly WordPress site operators, are urged to patch vulnerabilities, rotate credentials, and enable multi-factor authentication to reduce exposure to similar loader-based compromise chains.

## Mentioned in this report

- Malware: CastleRAT, Gootloader, Stealc
- Campaigns: Operation Endgame

## Detection guidance (public sample)

### Script Host Executing JScript Directly from a ZIP Extraction Folder

ATT&CK: T1189

A behavioural hunt for the technique in general. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

wscript/cscript running a .js file from the Temp1_*.zip folder created when a user opens an archive. This matches the Gootloader fake-document drive-by delivery chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Script Host Executing JScript Directly from a ZIP Extraction Folder
description: Detects wscript.exe or cscript.exe launching a .js file straight out
  of the Temp1_*.zip extraction folder that Windows creates when a user opens an archive.
  This is the typical Gootloader execution step after a victim downloads a fake legal
  document archive from a compromised website. Matches on the archive-extraction path
  pattern, not on specific file names.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
- attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \wscript.exe
    - \cscript.exe
    CommandLine|contains|all:
    - \Temp\Temp1_
    - .zip\
    - .js
  condition: selection
falsepositives:
- Administrators or developers double-clicking a legitimate JScript file inside a
  ZIP archive
- Software packages that ship JScript installers and are run directly from an opened
  archive
level: medium
id: 4cc6cb79-f492-5e2c-99b7-8671acb74ed5
status: experimental
author: Vorant
references:
- https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ea5d49ef-747c-56d0-8000-e1879c4a7564/operation-endgame-dismantles-gootloader-castlerat-stealc.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the malware and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup