# Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC infrastructure; 6M+ stolen credentials recovered

> Police in nine countries, working with Europol and private-sector partners, took down 235 servers and 257 domains behind the Gootloader loader, CastleRAT remote access trojan and StealC infostealer in the latest round of Operation Endgame, recovering more than 6 million credentials stolen from infected computers. Stolen credentials were sold to buyers who used them in further attacks, including ransomware.

- **Published:** 2026-11-12T13:59:01Z
- **Last reviewed:** 2026-11-13T16:35:51.406Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5862
- **ID:** TL-2026-5862
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 113 (3 shown free below)

## Description

In the week of 12 November 2026, law enforcement in nine countries, coordinated by Europol, disrupted infrastructure supporting three malware-as-a-service operations that feed the ransomware ecosystem: Gootloader (a loader), CastleRAT (a remote access trojan) and StealC (an infostealer with loader functionality). Per Help Net Security's report on the Europol announcement, 235 servers and 257 domains were taken down. Per-family figures: Gootloader 14 servers, 218 domains and 681 infected websites cleaned up; CastleRAT 120 servers and 39 domains; StealC 102 servers. The per-family server counts sum to 236 versus the stated total of 235; the source does not explain the one-server gap. More than 6 million credentials were recovered from infected computers. The source reports no arrests, named suspects or indicators of compromise.

Gootloader operators plant fake legal documents (contract and agreement templates) on compromised websites, often WordPress sites, and use search-engine poisoning to lure victims into downloading a ZIP containing an obfuscated JScript first stage run through wscript.exe. Vendor reporting (Red Canary, Kroll, Hivepro, Socura) describes follow-on stages delivering Cobalt Strike or other payloads, the Supper SOCKS5 backdoor, and the GootBot implant that communicates via the /xmlrpc.php endpoint of compromised WordPress sites. Access has been passed to ransomware affiliates; Hivepro and Socura name Vanilla Tempest, while IBM X-Force tracks the Gootloader operator as Hive0127 (UNC2565). Europol states Gootloader downloads led to ransomware and extortion.

CastleRAT has been known since 2025. Recorded Future's Insikt Group documented it in September 2025 as a RAT developed by TAG-150 (since renamed GrayBravo), which also operates the CastleLoader MaaS loader. It exists in Python (also called PyNightshade; eSentire tracks it as NightshadeC2) and C variants. Core functions are system information collection, payload download and execution, and CMD/PowerShell command execution; the C variant adds keylogging, screenshot capture, file transfer and cryptocurrency clipboard hijacking. Infections commonly begin with Cloudflare-themed ClickFix lures or fraudulent GitHub repositories. C2 is multi-tier, with Steam Community profiles acting as dead-drop resolvers. Europol links CastleRAT to encrypted data, crippled IT systems and ransom payments. Victim data tied to CastleRAT will be passed to notification services, including Have I Been Pwned.

StealC is an infostealer that harvests passwords, saved logins and digital identities for sale and fraud, and can drop further malware. This action continues work begun in June 2026, when Europol, Microsoft, Proofpoint and IBM X-Force disrupted StealC and Amadey (326 servers, 142 domains, nearly 27 million credentials) and, separately, SocGholish. In one observed chain, StealC downloaded XTinyLoader, which delivered LockBit Black ransomware.

Defender guidance: Europol advises changing credentials, enabling MFA and patching, especially WordPress. Because infostealer logs are sold on, hunt for session/credential reuse, reset exposed credentials and sessions, hunt for wscript.exe executing JScript from user-writable paths, and monitor WordPress sites for injected content and anomalous xmlrpc.php traffic. The takedown does not remove already-deployed implants or already-sold credentials, so residual risk remains.

## MITRE ATT&CK

- T1608.006 Stage Capabilities: SEO Poisoning
- T1584.006 Compromise Infrastructure: Web Services
- T1204.002 User Execution: Malicious File
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1056.001 Input Capture: Keylogging
- T1113 Screen Capture
- T1102.001 Web Service: Dead Drop Resolver
- T1090 Proxy
- T1189 Drive-by Compromise
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1140 Deobfuscate/Decode Files or Information
- T1070.001 Indicator Removal: Clear Windows Event Logs
- T1539 Steal Web Session Cookie
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1003.006 OS Credential Dumping: DCSync
- T1003.003 OS Credential Dumping: NTDS
- T1021.006 Remote Services: Windows Remote Management
- T1115 Clipboard Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1036 Masquerading
- T1070.004 Indicator Removal: File Deletion
- T1055 Process Injection
- T1614 System Location Discovery
- T1486 Data Encrypted for Impact
- T1608.004 Drive-by Target
- T1583.004 Acquire Infrastructure: Server
- T1583.001 Acquire Infrastructure: Domains
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1566 Phishing
- T1547.009 Boot or Logon Autostart Execution: Shortcut Modification

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Gootloader JScript Execution via wscript.exe from User-Writable or ZIP-Extract Path — Exploitation** (`TL-2026-5862-SPL-001`)

TL-2026-5862 (Operation Endgame). Detects wscript.exe or cscript.exe running a .js/.jse file from a ZIP-extraction or user-writable path (AppData, Temp, Temp1_*, Downloads, Public), the Gootloader first stage delivered via SEO-poisoned fake legal documents on compromised WordPress sites (T1204.002, T1059.007, T1027). Flags jQuery-style disguised filenames. Gootloader leads to Cobalt Strike, Supper SOCKS5 and ransomware hand-off.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.007, T1027
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational (EventCode 1), DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    (Image="*\\wscript.exe" OR Image="*\\cscript.exe")
    (CommandLine="*.js*" OR CommandLine="*.jse*")
    (CommandLine="*\\AppData\\*" OR CommandLine="*\\Temp\\*" OR CommandLine="*\\Temp1_*" OR CommandLine="*\\Downloads\\*" OR CommandLine="*\\Users\\Public\\*" OR CommandLine="*\\Content.Outlook\\*")
```Gootloader stage 1 - WSH runs obfuscated JScript from a ZIP extraction or user-writable path, often named like a jQuery library```
| eval jquery_disguise=if(match(lower(CommandLine), "jquery"), "yes", "no")
| eval zip_extract=if(match(lower(CommandLine), "temp1_"), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parent_process values(ParentCommandLine) as parent_cmd by host User Image CommandLine jquery_disguise zip_extract
| convert ctime(first_seen) ctime(last_seen)
| sort - count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine matches regex @"(?i)\.jse?\b"
| where ProcessCommandLine matches regex @"(?i)\\(AppData|Temp|Temp1_[^\\]*|Downloads|Users\\Public|Content\.Outlook)\\"
| extend JqueryDisguise = ProcessCommandLine contains "jquery", ZipExtract = ProcessCommandLine contains "Temp1_"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, JqueryDisguise, ZipExtract, SHA256
```

### Sigma

```yaml
title: Gootloader JScript Executed via Windows Script Host from User-Writable Path
id: 3f6c1a52-8e47-4b1d-9a0e-5d2c7b8e1a01
status: experimental
description: Detects wscript.exe or cscript.exe launching a .js or .jse file from a user-writable or ZIP-extraction path, the Gootloader first-stage pattern delivered through SEO-poisoned fake legal documents (TL-2026-5862).
references:
    - https://www.helpnetsecurity.com/2026/11/12/europol-operation-endgame-malware-takedown/
    - https://www.kroll.com/en/publications/cyber/deep-dive-gootloader-malware-infection-chain
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059.007
    - attack.defense-evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_script:
        CommandLine|contains:
            - '.js'
    selection_path:
        CommandLine|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Temp1_'
            - '\Downloads\'
            - '\Users\Public\'
            - '\Content.Outlook\'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative or logon scripts staged under user profile or temp paths
    - Software installers that run bundled JScript from the temp directory
level: high
```

**Known false positives:**

- Legitimate admin or logon scripts run by wscript/cscript from user profile or temp paths
- Software installers that unpack and run JScript from the temp directory

**Tuning notes:** Exclude known admin script share paths and signed deployment tooling by ParentImage or CommandLine. Raise priority when jquery_disguise or zip_extract is yes, or when the parent is explorer.exe, a browser or an archive tool. Consider blocking .js association with wscript.exe on endpoints.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix Paste-and-Run PowerShell or mshta Launched from Explorer — Exploitation (locked: unlock with TL Creds)
- StealC Infostealer Browser Credential Store File Activity by Non-Browser Process — Post-Exploitation (locked: unlock with TL Creds)
- Script-Host Outbound Connections and Community-Observed Sibling Infrastructure — C2 (locked: unlock with TL Creds)
- Gootloader Script Host Spawning PowerShell, cscript or LOLBin Child Chain — Exploitation (locked: unlock with TL Creds)
- Script Host or PowerShell Writing Run Key Persistence — Post-Exploitation (locked: unlock with TL Creds)
- GootBot C2 via WordPress xmlrpc.php POST Volume — C2 (locked: unlock with TL Creds)
- PowerShell Adds Microsoft Defender Exclusions or Disables Real-Time Monitoring — Post-Exploitation (locked: unlock with TL Creds)
- CastleRAT Steam Dead-Drop Resolver and Geolocation Lookups by Non-Browser Process — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 113)

Defanged, TLP:CLEAR.

- IP address: `103.253.42[.]91`
- Domain: `programsbookss[.]com`
- URL: `hxxp://45[.]93[.]20[.]64/c090b39aa5004512.php`

Full set of 113 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Operation Endgame malware takedown turns up over 6 million stolen logins](https://www.helpnetsecurity.com/2026/11/12/europol-operation-endgame-malware-takedown/)
- [Law enforcement hits StealC and Amadey malware networks (Help Net Security)](https://www.helpnetsecurity.com/?p=375957)
- [Amadey, StealC malware operations disrupted in Operation Endgame action (BleepingComputer)](https://www.bleepingcomputer.com/news/security/amadey-stealc-malware-operations-disrupted-in-operation-endgame-action/)
- [Operation Endgame](https://operation-endgame.com/)
- [From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure (Recorded Future)](https://recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations)
- [TAG-150 Develops CastleRAT in Python and C (The Hacker News)](https://thehackernews.com/2025/09/tag-150-develops-castlerat-in-python.html)
- [Shell to pay: Crims invade your PC with CastleRAT malware (The Register)](https://www.theregister.com/2025/09/05/clickfix_castlerat_malware/)
- [Return of Gootloader: Blending Technical Evasion with Operational Discipline (Hivepro)](https://www.hivepro.com/threat-advisory/return-of-gootloader-blending-technical-evasion-with-operational-discipline/)
- [Gootloader returns with GootBot supply chain (Socura)](https://socura.co.uk/threat-alerts/gootloader-returns-gootbot-supply-chain)
- [Deep Dive into GOOTLOADER Malware and Its Infection Chain (Kroll)](https://www.kroll.com/en/publications/cyber/deep-dive-gootloader-malware-infection-chain)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5862