Skip to navigation

Threat reportMalwareTL-2026-5862

Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC infrastructure; 6M+ stolen credentials recovered

highMONITORING

Police in nine countries, working with Europol and private-sector partners, took down 235 servers and 257 domains behind the Gootloader loader, CastleRAT remote access trojan and StealC infostealer in the latest round of Operation Endgame, recovering more than 6 million credentials stolen from infected computers.

Key facts

IdentifiersTL-2026-5862
Also known asOperation Endgame
SeverityHIGH
First disclosed
Affected productsMicrosoft Windows (endpoints infected by Gootloader, CastleRAT and StealC); WordPress WordPress sites compromised to host Gootloader lures (681 cleaned up)
MalwareCASTLELOADER, Cobalt Strike, GootBot, Gootloader, LockBit 3.0 - S1202, NightshadeC2 (Windows), PyNightshade, Stealc, Supper, XTinyLoader
ToolsCobalt Strike, GootLoader
MITRE ATT&CK techniquesT1003.003 OS Credential Dumping: NTDS, T1003.006 OS Credential Dumping: DCSync, T1005 Data from Local System, T1021.006 Remote Services: Windows Remote Management, T1027 Obfuscated Files or Information, T1027.003 Obfuscated Files or Information: Steganography, T1027.009 Obfuscated Files or Information: Embedded Payloads, T1036 Masquerading, T1053.005 Scheduled Task/Job: Scheduled Task, T1055 Process Injection, T1056.001 Input Capture: Keylogging, T1059.001 Command and Scripting Interpreter: PowerShell and 41 more in the attack flow
MotivationFINANCIAL
Target sectorsall sectors, legal, professional services, finance
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5862 across Splunk SPL, Microsoft KQL and Sigma, covering 113 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Gootloader JScript Execution via wscript.exe from User-Writable or ZIP-Extract Path — Exploitation

TL-2026-5862 (Operation Endgame). Detects wscript.exe or cscript.exe running a .js/.jse file from a ZIP-extraction or user-writable path (AppData, Temp, Temp1_*, Downloads, Public), the Gootloader first stage delivered via SEO-poisoned fake legal documents on compromised WordPress sites (T1204.002, T1059.007, T1027). Flags jQuery-style disguised filenames. Gootloader leads to Cobalt Strike, Supper SOCKS5 and ransomware hand-off.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.002, T1059.007, T1027
  • Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational (EventCode 1), DeviceProcessEvents
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    (Image="*\\wscript.exe" OR Image="*\\cscript.exe")
    (CommandLine="*.js*" OR CommandLine="*.jse*")
    (CommandLine="*\\AppData\\*" OR CommandLine="*\\Temp\\*" OR CommandLine="*\\Temp1_*" OR CommandLine="*\\Downloads\\*" OR CommandLine="*\\Users\\Public\\*" OR CommandLine="*\\Content.Outlook\\*")
```Gootloader stage 1 - WSH runs obfuscated JScript from a ZIP extraction or user-writable path, often named like a jQuery library```
| eval jquery_disguise=if(match(lower(CommandLine), "jquery"), "yes", "no")
| eval zip_extract=if(match(lower(CommandLine), "temp1_"), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parent_process values(ParentCommandLine) as parent_cmd by host User Image CommandLine jquery_disguise zip_extract
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine matches regex @"(?i)\.jse?\b"
| where ProcessCommandLine matches regex @"(?i)\\(AppData|Temp|Temp1_[^\\]*|Downloads|Users\\Public|Content\.Outlook)\\"
| extend JqueryDisguise = ProcessCommandLine contains "jquery", ZipExtract = ProcessCommandLine contains "Temp1_"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, JqueryDisguise, ZipExtract, SHA256

Sigma

title: Gootloader JScript Executed via Windows Script Host from User-Writable Path
id: 3f6c1a52-8e47-4b1d-9a0e-5d2c7b8e1a01
status: experimental
description: Detects wscript.exe or cscript.exe launching a .js or .jse file from a user-writable or ZIP-extraction path, the Gootloader first-stage pattern delivered through SEO-poisoned fake legal documents (TL-2026-5862).
references:
    - https://www.helpnetsecurity.com/2026/11/12/europol-operation-endgame-malware-takedown/
    - https://www.kroll.com/en/publications/cyber/deep-dive-gootloader-malware-infection-chain
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059.007
    - attack.defense-evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_script:
        CommandLine|contains:
            - '.js'
    selection_path:
        CommandLine|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Temp1_'
            - '\Downloads\'
            - '\Users\Public\'
            - '\Content.Outlook\'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative or logon scripts staged under user profile or temp paths
    - Software installers that run bundled JScript from the temp directory
level: high

Known false positives:

  • Legitimate admin or logon scripts run by wscript/cscript from user profile or temp paths
  • Software installers that unpack and run JScript from the temp directory

Tuning notes: Exclude known admin script share paths and signed deployment tooling by ParentImage or CommandLine. Raise priority when jquery_disguise or zip_extract is yes, or when the parent is explorer.exe, a browser or an archive tool. Consider blocking .js association with wscript.exe on endpoints.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ClickFix Paste-and-Run PowerShell or mshta Launched from Explorer — Exploitation · unlock with TL Creds
  • StealC Infostealer Browser Credential Store File Activity by Non-Browser Process — Post-Exploitation · unlock with TL Creds
  • Script-Host Outbound Connections and Community-Observed Sibling Infrastructure — C2 · unlock with TL Creds
  • Gootloader Script Host Spawning PowerShell, cscript or LOLBin Child Chain — Exploitation · unlock with TL Creds
  • Script Host or PowerShell Writing Run Key Persistence — Post-Exploitation · unlock with TL Creds
  • GootBot C2 via WordPress xmlrpc.php POST Volume — C2 · unlock with TL Creds
  • PowerShell Adds Microsoft Defender Exclusions or Disables Real-Time Monitoring — Post-Exploitation · unlock with TL Creds
  • CastleRAT Steam Dead-Drop Resolver and Geolocation Lookups by Non-Browser Process — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 113 indicators of compromise for TL-2026-5862.

Sample indicators (3 of 113)

  • IP address: 103.253.42[.]91
  • Domain: programsbookss[.]com
  • URL: hxxp://45[.]93[.]20[.]64/c090b39aa5004512.php

Defanged, TLP:CLEAR. Full set of 113 indicators: unlock with TL Creds.

113 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Stolen credentials were sold to buyers who used them in further attacks, including ransomware.

In the week of 12 November 2026, law enforcement in nine countries, coordinated by Europol, disrupted infrastructure supporting three malware-as-a-service operations that feed the ransomware ecosystem: Gootloader (a loader), CastleRAT (a remote access trojan) and StealC (an infostealer with loader functionality). Per Help Net Security's report on the Europol announcement, 235 servers and 257 domains were taken down. Per-family figures: Gootloader 14 servers, 218 domains and 681 infected websites cleaned up; CastleRAT 120 servers and 39 domains; StealC 102 servers. The per-family server counts sum to 236 versus the stated total of 235; the source does not explain the one-server gap. More than 6 million credentials were recovered from infected computers. The source reports no arrests, named suspects or indicators of compromise.

Gootloader operators plant fake legal documents (contract and agreement templates) on compromised websites, often WordPress sites, and use search-engine poisoning to lure victims into downloading a ZIP containing an obfuscated JScript first stage run through wscript.exe. Vendor reporting (Red Canary, Kroll, Hivepro, Socura) describes follow-on stages delivering Cobalt Strike or other payloads, the Supper SOCKS5 backdoor, and the GootBot implant that communicates via the /xmlrpc.php endpoint of compromised WordPress sites. Access has been passed to ransomware affiliates; Hivepro and Socura name Vanilla Tempest, while IBM X-Force tracks the Gootloader operator as Hive0127 (UNC2565). Europol states Gootloader downloads led to ransomware and extortion.

CastleRAT has been known since 2025. Recorded Future's Insikt Group documented it in September 2025 as a RAT developed by TAG-150 (since renamed GrayBravo), which also operates the CastleLoader MaaS loader. It exists in Python (also called PyNightshade; eSentire tracks it as NightshadeC2) and C variants. Core functions are system information collection, payload download and execution, and CMD/PowerShell command execution; the C variant adds keylogging, screenshot capture, file transfer and cryptocurrency clipboard hijacking. Infections commonly begin with Cloudflare-themed ClickFix lures or fraudulent GitHub repositories. C2 is multi-tier, with Steam Community profiles acting as dead-drop resolvers. Europol links CastleRAT to encrypted data, crippled IT systems and ransom payments. Victim data tied to CastleRAT will be passed to notification services, including Have I Been Pwned.

StealC is an infostealer that harvests passwords, saved logins and digital identities for sale and fraud, and can drop further malware. This action continues work begun in June 2026, when Europol, Microsoft, Proofpoint and IBM X-Force disrupted StealC and Amadey (326 servers, 142 domains, nearly 27 million credentials) and, separately, SocGholish. In one observed chain, StealC downloaded XTinyLoader, which delivered LockBit Black ransomware.

Defender guidance: Europol advises changing credentials, enabling MFA and patching, especially WordPress. Because infostealer logs are sold on, hunt for session/credential reuse, reset exposed credentials and sessions, hunt for wscript.exe executing JScript from user-writable paths, and monitor WordPress sites for injected content and anomalous xmlrpc.php traffic. The takedown does not remove already-deployed implants or already-sold credentials, so residual risk remains.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.003 OS Credential Dumping: NTDS; T1003.006 OS Credential Dumping: DCSync; T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Collection

T1005 Data from Local System; T1056.001 Input Capture: Keylogging; T1113 Screen Capture; T1115 Clipboard Data

Lateral Movement

T1021.006 Remote Services: Windows Remote Management

Defense Evasion

T1027 Obfuscated Files or Information; T1027.009 Obfuscated Files or Information: Embedded Payloads; T1036 Masquerading; T1055 Process Injection; T1070.001 Indicator Removal: Clear Windows Event Logs; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Stealth

T1027.003 Obfuscated Files or Information: Steganography; T1218.003 System Binary Proxy Execution: CMSTP

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1112 Modify Registry; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder; T1547.009 Boot or Logon Autostart Execution: Shortcut Modification; T1574.002 Hijack Execution Flow: DLL Side-Loading

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File; T1204.004 User Execution: Malicious Copy and Paste

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1090.001 Proxy: Internal Proxy; T1102.001 Web Service: Dead Drop Resolver; T1105 Ingress Tool Transfer; T1132.001 Data Encoding: Standard Encoding; T1219 Remote Access Tools; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1614 System Location Discovery

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Impact

T1486 Data Encrypted for Impact

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1583.004 Acquire Infrastructure: Server; T1584.004 Compromise Infrastructure: Server; T1584.006 Compromise Infrastructure: Web Services; T1608.001 Stage Capabilities: Upload Malware; T1608.004 Drive-by Target; T1608.006 Stage Capabilities: SEO Poisoning

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

  • Patch WordPress core, themes and plugins promptly, as advised by Europol

Immediate actions

  • Reset credentials and invalidate sessions/tokens for any account that may have been exposed on hosts infected with StealC, CastleRAT or Gootloader
  • Enforce multi-factor authentication on all accounts, especially WordPress administrators, VPN and email
  • Check Have I Been Pwned and other notification services for exposure of organizational domains and users
  • Hunt for wscript.exe launching JScript from archives or user-writable paths, and for PowerShell adding Windows Defender exclusions

Workarounds

  • Block or restrict xmlrpc.php on WordPress sites that do not need it
  • Associate .js files with a text editor rather than wscript.exe on endpoints

Longer-term hardening

  • Deploy EDR with behavioral detection for script-host abuse, infostealer credential-store access and ClickFix-style clipboard-paste execution
  • Restrict browser-saved credentials and move to phishing-resistant authentication
  • Monitor outbound traffic for non-standard TLS on TCP/443 and for Steam Community profile lookups from servers

Affected and fixed versions

  • Microsoft — Windows (endpoints infected by Gootloader, CastleRAT and StealC)
    Vulnerable versions: Not version-specific; user-execution based
  • WordPress — WordPress sites compromised to host Gootloader lures (681 cleaned up)
    Vulnerable versions: Unpatched or weakly credentialed installations

Timeline

Last updated · 7 updates · revalidated 7× · latest source

Showing the 20 most recent tracked events.

  • Huntress publishes analysis of Gootloader's WOFF2 font obfuscation, Startup-folder persistence and the Supper SOCKS5 backdoor.
  • The Register reported Gootloader back in operation and serving ransomware, with vendor reporting linking hand-offs to Vanilla Tempest.
  • Recorded Future reclassifies TAG-150 as GrayBravo and details four CastleLoader customer clusters.
  • Expel findings published: Gootloader delivers malformed ZIPs built from 500-1,000 concatenated archives with a truncated EOCD record, so WinRAR and 7-Zip fail while the default Windows unarchiver opens them.
  • First CastleRAT NSIS installer compiled (later documented by JUMPSEC); a second follows on 2026-03-13.
  • JUMPSEC publishes CastleRAT/ChainShell analysis with hashes, C2 IPs and domains, and behavior details.
  • Microsoft links 140,000+ infected computers to Amadey and StealC in the first two weeks of May 2026.
  • June phase of Operation Endgame begins (15-19 June), targeting Amadey, StealC and related infrastructure.
  • Operation Endgame disruption of SocGholish announced, prior phase of the same campaign.
  • June Operation Endgame action concludes; first StealC takedown of 2026.
  • Europol announces StealC and Amadey takedown (326 servers, 142 domains, nearly 27 million credentials) with Microsoft, Proofpoint and IBM X-Force; StealC work continues in November.
  • US DOJ announces the FBI seized locked-ioc-48, domain of the Russian-speaking bulletproof hosting provider Virtualine.
  • SecurityWeek reports court documents show StealC operators paid Virtualine in 2026.
  • Coordinated November action against StealC, Gootloader and CastleRAT infrastructure begins (reported window 9-11 November, per German police).
  • Shadowserver Foundation with ISPs and CSIRTs began identifying and notifying systems infected with Gootloader.
  • US DoJ announces Gootloader removed from over 100 servers, including compromised WordPress sites, and US domains seized (now showing a seizure banner); warrants unsealed.
  • Europol and Eurojust report about 6.4 million victim datasets identified on seized Endgame infrastructure, distributed via HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, Shadowserver and NL-NCSC.
  • Police in nine countries with Europol take down 235 servers and 257 domains for Gootloader, CastleRAT and StealC; 6M+ credentials recovered and 681 Gootloader-infected websites cleaned up.
  • The Record reported DOJ court-document details: Gootloader operating since 2018, about 25,000 devices infected, 44+ U.S. victims later hit by ransomware, about $28.8M in losses; victims included Defense Industrial Base entities.
  • Have I Been Pwned adds the CastleRAT dataset supplied by Europol (179.7k email addresses, 893k unique passwords).

Update history

Sources cited

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated . Reviewed .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats