Police Seize 218 Gootloader Domains as Operation Endgame Hits Malware Networks

Police in six countries have taken down a major malware operation called Gootloader. The group hacked WordPress websites and pushed poisoned links to the top of search results. A single click on those links could lead to a ransomware attack.

The Dutch police led in the process, with the operation shutting down 218 domains and removing 681 compromised websites. The same week, authorities shut down CastleRAT, a program that steals passwords and cryptocurrency wallet information without the consent of users. Authorities also incapacitated the StealC infostealer for the second time since June.

How Gootloader Tricked Search Users

Gootloader operated by contaminating search results. The gang accessed real WordPress websites and created false pages. These pages seemed like forums discussing legal agreements or business contacts. As a result, whenever someone searched for the subject matter related to them, the fake websites surfaced at the top.

Gootloader is not the only malware campaign to exploit search engine rankings. In another reported campaign, hackers used SEO poisoning to spread fake VPN apps that steal corporate credentials, showing how attackers can abuse search results to distribute malicious software and target sensitive information.

The websites entailed documents that appeared to be useful. People who downloaded and opened them end up infecting their computers. The malicious software provided access to a back door for other attackers. The latter could install ransomware and ask for payment.

In this way, normal web searches turned out to be a trap. A user who was looking for a contract template could easily surrender his entire computer system. The attackers didn’t have to do anything special to carry out the offensive launch directly. They just waited for someone to stumble on the poisoned pages.

Furthermore, the fake pages looked highly believable. They contained comments left by non-existent users & file previews. Some pages even adopted links to real sites to gain trust. Such efforts made it difficult for people to spot the fraud even for some cautious ones.

The Scale of the Operation

Operation Endgame involved law enforcement from 9 countries that include the Netherlands, Germany, the UK, and the US. Europol and Eurojust worked as the coordinators of the operation.

Through the operation, the officials seized 235 servers and 257 domains across 3 malware families. In the case of Gootloader, law enforcement managed to take down 14 servers and 218 domains. The clean-up operation cleared 681 infected websites.

The operation against CastleRAT brought 120 servers and 39 domains down. CastleRAT helped attackers remotely access the infected devices of the victims and to encrypt data and force them to pay.

Furthermore, StealC had lost 102 servers in this case. This malware targets devices running with the Windows operating system by collecting passwords, cookies, and log-in information. Such details are available to criminals could use for break ins or sales to their attackers.

Operation Endgame has taken place in multiple waves since 2024, each time getting rid of several servers that criminals use. The pattern shows that takedowns work best when police strike repeatedly. Notably, a single raid will allow the criminals to rebuild but repeated raids raise their costs.

Recovery of Millions of Stolen Records

According to reports, seized infrastructures revealed over 6.4 million stolen credentials. The stolen records are from compromised machines and include username and passwords for individuals & various services.

The data will be sent to different platforms for notifications. These include Have I Been Pwned, DIVD, CheckjeHack, plus the checking tool of the Dutch Police. By checking in such services, people will learn if their email addresses are available in the stolen records.

The Dutch police stated that even after the seizure, criminals might still have access to the data. At this point, they advised the affected people to change the password and enable two-factor authentication. WordPress owners should change their passwords as well as patch all vulnerabilities.

Steps that Users Can Take

If someone has downloaded any files from a forum site, they should treat their machine compromised tools. They need to perform a complete antivirus checkup and change all of their passwords on a clean computer. This is important since saved browser passwords are most probably at risk.

Those who use WordPress should examine their sites for unauthorized accounts and altered files. It is also advisable to have plugins and themes updated. Strong passwords and two-factor logins make a site less vulnerable to intrusions.

People can look for their email address on the ‘Check je hack’ page of the Dutch police or ‘Have I Been Pwned.’ The search result will reveal whether this email is part of the database of the hacker. However, a clean search result does not guarantee that the computer is safe, as the malware can still be in your machine.

Another important thing to do is to pay attention to unusual activities in your browser. Sudden redirects and appearance of new toolbars may be indications of an infection. To get rid of the infection, one needs to delete unknown extensions and reset the browser.