Europol and police agencies from nine countries have taken down the infrastructure behind three malware families that feed ransomware crews: the Gootloader loader, the CastleRAT remote access trojan and the StealC infostealer. The action was announced on 12 November and removed 235 servers and 257 domains from service.
What happened
Investigators found 6.4 million victim datasets on the seized infrastructure, credentials and profiles harvested from infected machines and held for resale. Europol said the stolen logins were being sold on for further attacks, ransomware included.
Gootloader was the entry point. It spread through fake legal documents hosted on compromised websites, frequently hijacked WordPress sites that ranked well in search results. CastleRAT gave operators hands-on control of infected Windows machines, and StealC harvested passwords, session cookies and cryptocurrency wallets.
The operation is part of Operation Endgame, the multi-country effort against malware and ransomware enablers. Agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States took part, coordinated by Europol and Eurojust.
Who is affected
Two groups: anyone who opened a document from a site they did not recognise, and every organisation running a WordPress site nobody maintains.
- WordPress site owners whose installations were used to host the lure documents.
- Windows users who opened a fake contract, lease or legal template in the past year.
- Organisations whose staff reuse work passwords on personal accounts, and the reverse.
What to do now
Treat any credential that touched an infected machine as stolen, and check your domains against the published breach feeds.
- Search your work email domains on Have I Been Pwned and the Shadowserver Foundation; the CastleRAT data is being released through those platforms.
- Reset passwords for every account that appears in the results, starting with email, Microsoft 365 and banking.
- Turn on multi-factor authentication for WordPress administrators and for the mailbox that resets those accounts.
- Patch WordPress core and every plugin, delete unused plugins and themes, and remove administrator accounts nobody recognises.
- Read logs for logins from new locations since mid-year, and for remote-access tools nobody on the team installed.
What this means for South African businesses
WordPress carries a large share of South African SME websites, and the Gootloader lure is exactly what an office manager clicks: a search result offering a contract, a lease or a legal template. A takedown cuts the supply of new infections, but it does not clean machines that are already compromised, so the credential reset is the step that actually protects a local business. My judgement is that the WordPress half of this story is the half most South African SMEs will ignore, and it is the half that leads to ransomware.
Source
Source: Europol, 6.4 million victim datasets secured in international operation against malware networks.