What Happened
The latest Operation Endgame action hit three malware services at once. Law enforcement in nine countries, Canada among them, seized 257 domains and 235 servers tied to the Gootloader loader, the StealC infostealer, and the CastleRAT remote access trojan, BleepingComputer reports. Europol and Eurojust coordinated the operation alongside Bulgaria, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States.
Investigators found about 6.4 million victim datasets on the seized infrastructure. These are credentials and session data stolen from infected machines and sold on for follow-on attacks, ransomware included. HaveIBeenPwned, Shadowserver, DIVD, NL-NCSC, and other partners now distribute the data to victims. No arrests were announced.
Why This Matters for Canadian Organizations
Gootloader spreads through poisoned search results and compromised WordPress sites. It targets people searching for legal templates and business agreements, a lure aimed squarely at office workers. StealC harvests saved browser passwords and cookies. Those logs feed initial access brokers, who sell entry to ransomware crews.
Canada’s role in the operation gives every Canadian security team a reason to check the recovered data. Earlier Endgame phases against Amadey and StealC recovered 27 million credentials. Each stolen session cookie or VPN password in these datasets is a ready-made door into a Canadian network. Under PIPEDA and Quebec’s Law 25, an infostealer infection exposing customer data triggers breach assessment duties. Takedowns slow operators down, but criminal groups rebuild infrastructure within weeks.
What to Do
Subscribe your corporate domains to HaveIBeenPwned domain search and Shadowserver reports today. Force password resets and revoke active sessions for any matched account. Hunt for Gootloader artifacts, including JavaScript files launched from ZIP archives in user download folders. Block execution of .js files through wscript for standard users. If you run WordPress, update credentials, enable multi-factor authentication, and patch plugins. Report confirmed infections to the Canadian Centre for Cyber Security. Follow our Trends coverage and latest news for updates.
