An international police operation took down servers behind the Gootloader loader, the CastleRAT remote access trojan and the StealC infostealer this week, The Hacker News reports. Germany’s BKA says police seized about 6.4 million stolen logins from more than 40,000 victims. Europol says 235 servers and 257 domains were seized across the three.
Gootloader spread through fake legal documents on hacked websites, often WordPress, pushed up in search results with SEO poisoning. The U.S. Justice Department says it infected at least 25,000 computers since 2018 and was used in ransomware attacks on at least 44 U.S. victims, about $28.8 million in losses. German police gave a much higher count. For Gootloader alone, police took down 14 servers and 218 domains and cleaned malware from 681 hacked websites, and U.S. agencies removed it from more than 100 servers, including hacked WordPress sites.
My take
Good work by the good guys. But notice how much of this ran on hacked WordPress sites. If you run WordPress, keep core, themes and plugins patched, kill accounts you don’t use, and watch for pages you didn’t write.
God Bless, and Happy hacking!
