Operation Endgame seized infrastructure, not stolen logins
Europol says police in nine countries seized 235 servers and 257 domains in the latest Operation Endgame action against Gootloader, CastleRAT and StealC, identifying 6.4 million stolen credentials. Authorities also cleaned 681 infected websites; victim data is to be shared with notification services including Have I Been Pwned and the Shadowserver Foundation.
Gootloader spread through fake legal documents hosted on compromised sites, including hacked WordPress sites; people who downloaded them infected their computers. Malware on infected machines could collect saved passwords and digital identities, which operators sold to buyers for fraud and further attacks, including ransomware.
Taking down servers and domains disrupts the malware operations, but does not invalidate credentials already copied or sold. If an organization’s users were infected, those logins may still open accounts or support follow-on fraud after delivery sites are cleaned up. The operation does not establish which credentials remain active or whether buyers have used them.