Dutch police take down 100 servers in global malware crackdown

Dutch police and the Public Prosecution Service (OM) took part in an international action week that disabled the Gootloader malware, dismantled the CastleRAT tool and hit the StealC infostealer again. It is part of Operation Endgame. Worldwide, more than 6.4 million stolen personal data records were secured, police said on Thursday.

Police say the criminals behind these networks have victimised millions of people worldwide since 2018. Gootloader was one of the most widely used and dangerous types of malware of recent years. Criminals pushed untrustworthy websites high in search results by infecting WordPress sites. People who clicked ended up on criminal sites, and an infection could end in a ransomware attack that locks files and systems.

Dutch police switched off 14 Gootloader servers. Together with international partners, the Netherlands seized 218 domain names and disinfected 681 websites. Investigators also carried out actions aimed at the main suspect behind Gootloader.

CastleRAT was dismantled: 120 servers were taken down, 6 of them in the Netherlands, and 39 domains were seized. Of 102 StealC servers taken down, 80 were switched off by Dutch police. Since the previous takedown in June, police have been watching continuously for new StealC infostealers.

Police explain that infostealers and remote access tools (RATs) steal log-ins, passwords, crypto wallets and system information. Criminals can use these to steal money or enter company networks. Such tools are often the first link in an attack chain, police say.

The national high tech crime team and the North Holland cybercrime team played a large role, under the authority of the national public prosecutor's office (Landelijk Parket). Investigators worked together with Germany, Denmark, the United Kingdom, the United States and Canada, supported by Europol and Eurojust.