Bulgarian Cybercrime Officers Help Dismantle Malware Networks Affecting Millions of Victims 2026

Officers from Bulgaria’s Cybercrime Directorate at the General Directorate for Combating Organized Crime (GDCOC) participated in an international operation that dismantled criminal infrastructure linked to three types of malware: Gootloader, CastleRAT and StealC, the directorate announced on Friday.
The operation involved law enforcement agencies from nine countries and was coordinated by Europol and Eurojust. It targeted criminal infrastructure supporting other forms of cybercrime, including ransomware attacks and data theft.
The action was part of Operation ENDGAME, the largest international initiative to date targeting criminal infrastructure that facilitates ransomware attacks.
Gootloader is malware that enables unauthorised access to computer systems by distributing fake legal documents through compromised websites, often hacked WordPress sites. Victims who download these documents risk infecting their computers, allowing criminals to carry out further attacks, including ransomware installation and digital extortion. The operation against Gootloader resulted in the takedown of 14 servers and 218 domains, while 681 infected websites were cleaned.
CastleRAT is a remote access trojan (RAT) known since 2025. It allows attackers to control infected computers remotely and use them for criminal purposes, including encrypting data and disrupting entire IT systems to extort ransom payments from affected companies and organizations. Authorities seized 120 servers and 39 domains associated with CastleRAT. Information about affected users will also be shared with platforms to help notify victims of stolen credentials.
StealC is designed to extract sensitive information from compromised computers, including passwords, stored login credentials and digital identities. The stolen information is subsequently made available for illegal activities, particularly data trading and fraudulent use. Authorities dismantled 102 servers associated with StealC, continuing enforcement efforts that began in June 2026.
Europol announced that information concerning affected users would be made available through several platforms, including Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC. These services will help notify victims whose access credentials were stolen following CastleRAT infections.
WordPress users are advised to update their passwords, enable multi-factor authentication and install the latest security updates to address potential vulnerabilities.

Bulgarian Cybercrime Officers Help Dismantle Malware Networks Affecting Millions of Victims 2026 THE NEWS FROM BULGARIA – NEWS AGENCY 2009-2025 2026-11-13 05:20:27

World news, international news, global news, latest world news, breaking world news, world politics, international politics. Global economy, international business, world markets, global events, international relations, geopolitical news, global affairs. Europe news, European news, EU news, European politics, Balkan news, United States news, UK news, Asia news. Bulgarians abroad, Bulgarian diaspora, Bulgarians overseas, Bulgarian communities abroad, Bulgarian citizens abroad, Bulgarian expats, Bulgarian emigrants. Bulgarian diaspora news, news for Bulgarians abroad, Bulgaria abroad, Bulgarians in Europe, Bulgarians in Germany, Bulgarians in the UK. Bulgarians in Spain, Bulgarians in Italy, Bulgarians in France, Bulgarians in the USA, Bulgarians in Canada, Bulgarians in Greece. Bulgarian communities worldwide, Bulgarian schools abroad, Bulgarian culture abroad, Bulgarian businesses abroad, Bulgarian students abroad, Bulgarian workers abroad. Consular services Bulgaria, Bulgarian embassies, Bulgarian citizens overseas, Bulgarian elections abroad, Bulgarian voting abroad, Bulgarian nationals abroad, Bulgaria international relations.

BULGARIA NEWS – NEWS AGENCY 2009–2026 2026-11-13 05:20:27