Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins

thehackernews.com Nov 13, 2026

Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins

Curated by Shubham · TechCapsules · Nov 13, 2026

AI-summarised brief · reviewed before publication

An international police operation dubbed Operation Endgame dismantled the infrastructure behind three malware families—Gootloader, CastleRAT and StealC—seizing 235 servers, 257 domains and roughly 6.4 million stolen login credentials belonging to more than 40 000 victims. Gootloader, a loader that has infected at least 25 000 computers since 2018 and facilitated ransomware attacks causing about $28.8 million in U.S. losses, was removed from 14 servers, 218 domains and 681 hacked WordPress sites. CastleRAT’s 120 servers and 39 domains were seized, while StealC’s servers were taken down again after a June takedown, despite a brief resurgence via a bullet‑proof host. No arrests were announced, but victims can check compromised emails through a new police service and data is being shared with Have I Been Pwned and the Shadowserver Foundation.

💡 Why It Matters

· By crippling the command‑and‑control backbone of these prolific tools, law enforcement has halted a pipeline that feeds ransomware gangs with fresh victims and millions of stolen credentials.

Capsules Cybersecurity

Read full article on thehackernews.com

PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code…

PTC has issued emergency patches for a critical vulnerability identified as CVE‑2026‑126325 affecting its Windchill product lifecycle management and FlexPLM PLM platforms. The flaw, rated 9.2 on the CVSS v4 scale, stems from improper input validation and deserialization of untrusted data, enabling remote code execution through crafted requests. PTC confirms that hosted customers receive the fix automatically, while on‑premise users must apply the update themselves. The disclosure follows a prior RCE bug (CVE‑2026‑12569) that was actively exploited and later weaponized by the Cl0p ransomware group to drop JSP web shells and exfiltrate proprietary manufacturing data. Security experts warn that compromised Windchill/FlexPLM instances can facilitate widespread network intrusion, data theft, and disruption of time‑sensitive production processes. Organizations are urged to patch immediately or enforce strict network segmentation to mitigate risk.

💡 Unpatched PLM systems give attackers a direct foothold inside manufacturing networks, turning product data into a high‑value ransom lever.

thehackernews.com · Nov 12

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue…

ConnectWise disabled five third‑party extensions in partner environments after reports of unauthorized access. The company confirmed no evidence of a ScreenConnect software flaw and identified about 400 partner sites with the extensions installed. Cybersecurity firm Huntress traced attackers using compromised credentials or hijacked sessions to push rogue ScreenConnect clients to at least 288 endpoints across 48 organizations. The malware, named SCKit, establishes persistent remote access, installs a second attacker‑controlled client, and creates a relay trap to intercept session cookies. The attack spreads in a worm‑like two‑step process from infected endpoints to technicians and then to other endpoints.

💡 The incident exposes how vulnerable third‑party extensions can become a conduit for sophisticated lateral movement, underscoring the need for strict access controls and continuous monitoring in partner ecosystems.

thehackernews.com · Nov 12

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

A critical vulnerability (CVE‑2026‑119618) in Apache HTTP Server’s HTTP/2 module (mod_http2) allows unauthenticated remote attackers to execute code on affected servers. The flaw, rated 9.8/10 on CVSS, impacts versions 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8–2.0.42. Red Hat released a patched package (2.4.71) and updated RHEL 9 and 10 yesterday, while other distributions are following suit. Administrators must disable HTTP/2 or upgrade to the fixed release to mitigate the risk.

💡 The flaw exposes servers to full control without authentication, threatening critical infrastructure that relies on Apache’s widespread deployment. Prompt patching is essential to prevent potential large‑scale compromises.

thehackernews.com · Nov 12

Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer…

An attacker leveraged credentials from 4,837 compromised GitHub accounts to deploy a secret‑stealing script across at least 1,806 repositories. The malicious code, inserted via pull requests titled “docs: dependency audit notes,” accessed CI workflow secrets, cloud credentials, and runtime tokens, then exfiltrated them to external servers or Telegram. SafeDep identified 8,093 repositories that received malicious commits, with 7,309 containing the stealer. Aikido Security warned that any account that opened a test pull request is compromised, urging owners to revoke tokens, enable 2FA, and rotate secrets.

💡 The breach exposes the breadth of GitHub’s supply‑chain risk, showing how compromised accounts can silently harvest cloud credentials across thousands of projects, potentially enabling attackers to pivot into deeper cloud infrastructures.

thequantuminsider.com · Nov 12

CyberRisk Collaborative Announces Virtual Event on Post-Quantum Readiness

CyberRisk Collaborative announced a virtual event, “Post‑Quantum Readiness: Preparing for Q‑Day,” scheduled for January 26, 2027. The program targets CISOs and senior security leaders, offering five 20‑minute sessions on quantum‑computing risks, cryptographic asset inventory, post‑quantum standards, migration planning, and enterprise governance. Speakers include representatives from the Foundation for Defense of Democracies, SAP, Georgia Tech, Citi, and NewYork‑Presbyterian Hospital. Sessions will be available on demand after the live event.

💡 The event equips leaders with actionable strategies to counter the looming threat of quantum‑enabled cryptographic breakage, ensuring long‑term data protection and regulatory compliance.

thehackernews.com · Nov 12

Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak…

Node.js released critical updates for its 22.x, 24.x, and 26.x lines, fixing 16 vulnerabilities, including two high‑severity HTTP/2 flaws that let unauthenticated clients crash servers or leak memory from other connections. CVE‑2026‑123863 causes crashes when a default HTTP/2 server replies before the request body arrives, while CVE‑2026‑123866 exposes memory across streams. A separate HTTPS flaw (CVE‑2026‑123864) permits reading of TLS keys and other users’ data. All affected versions now have patched releases; end‑of‑life lines remain vulnerable.

💡 The fixes prevent attackers from crashing Node.js‑based services or exfiltrating sensitive data, safeguarding critical web infrastructure that relies on HTTP/2 and HTTPS.