{"id":4287,"date":"2026-11-14T10:57:45","date_gmt":"2026-11-14T18:57:45","guid":{"rendered":"https:\/\/cyber.mag212.com\/operation-endgame-gootloader-binance-funds-facestealer\/"},"modified":"2026-11-14T10:57:45","modified_gmt":"2026-11-14T18:57:45","slug":"operation-endgame-gootloader-binance-funds-facestealer","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/operation-endgame-gootloader-binance-funds-facestealer\/","title":{"rendered":"Operation Endgame Hits Gootloader as DOJ Moves on Binance-Theft Funds and FaceStealer"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><em>From the <a href=\"https:\/\/cyber.mag212.com\/the-keys-were-already-inside-mag212-cyber-weekly-november-14-2026\/\">MAG212 CYBER Weekly, 14 November 2026<\/a>. Status labels: confirmed by vendor, reported by researchers, or unverified. Every command below is copied from official documentation and was <strong>not tested by MAG212<\/strong>; run it only on systems you are authorised to administer.<\/em><\/p>\n\n\n\n<p class=\"m2-status wp-block-paragraph\"><strong>Status:<\/strong> <strong>Confirmed by government.<\/strong> DOJ Press Release 26-1351 (12 Nov) covers Gootloader <sup><a href=\"#src-47\">[47]<\/a><\/sup>. The Binance and FaceStealer actions are reported by The Record (12 Nov); the DOJ and FBI primary releases were not fetched <sup><a href=\"#src-51\">[51]<\/a><\/sup>. Europol&#8217;s own totals are <strong>unverified<\/strong> because its newsroom could not be retrieved <sup><a href=\"#src-48\">[48]<\/a><\/sup>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened \u2014 Gootloader<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On 12 November DOJ said Gootloader had been removed from &#8220;over 100 servers, including compromised WordPress sites&#8221;, and that US domains used to deliver and control it had been seized under court authorisation, as part of <strong>Operation Endgame<\/strong> <sup><a href=\"#src-47\">[47]<\/a><\/sup>. According to DOJ <sup><a href=\"#src-47\">[47]<\/a><\/sup>:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why this matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Takedowns disrupt the delivery networks behind ransomware, but operators rebuild. Defenders should use the window to hunt for existing Gootloader footholds and close the search-poisoning and script-execution paths it relies on. The DOJ actions also show how fake meeting invitations now deliver infostealers. <em>(MAG212 analysis)<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/operation-endgame-gootloader-binance-funds-facestealer-diagram.png\"><img decoding=\"async\" src=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/operation-endgame-gootloader-binance-funds-facestealer-diagram.png\" alt=\"Gootloader infection path from a search for a legal template through a hacked WordPress site, script execution and persistence to ransomware, crossed out by Operation Endgame, plus a FaceStealer fake-meeting panel.\"\/><\/a><figcaption class=\"wp-element-caption\">Diagram: MAG212 CYBER. Solid red = observed or vendor-confirmed; dashed amber = reported or unverified; green = recommended control.<\/figcaption><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>at least <strong>25,000<\/strong> computers infected worldwide since 2018<\/li>\n\n<li>ransomware attacks on at least <strong>44 US victims<\/strong>, with about <strong>$28.8 million<\/strong> in losses<\/li>\n\n<li>targets included the US Department of War and the Defense Industrial Base<\/li>\n\n<li>infected machines joined a botnet, and operators sold access to ransomware actors<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The Record says the wider action dismantled more than 100 StealC servers on Thursday and disrupted <strong>235 servers and 257 domains<\/strong> used by Gootloader, CastleRAT and StealC. Seized domains show a seizure banner, and Shadowserver is notifying victims <sup><a href=\"#src-48\">[48]<\/a><\/sup>. <strong>No arrests or defendants<\/strong> were named <sup><a href=\"#src-47\">[47]<\/a><\/sup><sup><a href=\"#src-48\">[48]<\/a><\/sup>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Partners<\/strong> <sup><a href=\"#src-47\">[47]<\/a><\/sup>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Law enforcement:<\/strong> BKA (Germany), the Netherlands Police, RCMP and Ottawa Police (Canada), Danish Police, BL2C (Paris), the UK NCA, the AFP and Europol.<\/li>\n\n<li><strong>Technical and private:<\/strong> Shadowserver, Fraunhofer FKIE, Registrar of Last Resort, OpenAI and Sharktech.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What happened \u2014 Binance and FaceStealer<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">DOJ obtained court authorisation to seize or restrain <strong>more than $1.2 billion<\/strong> from October&#8217;s roughly $6.3 billion Binance theft. That sum is part of $2.7 billion frozen by platforms. Binance and the FBI attribute the theft to North Korea&#8217;s TraderTraitor <sup><a href=\"#src-51\">[51]<\/a><\/sup>. FBI and DOJ also disrupted cloud infrastructure behind <strong>&#8220;FaceStealer&#8221;<\/strong>, fake-meeting malware the FBI attributes to <strong>APT38<\/strong>, with about <strong>$400 million<\/strong> stolen over 18 months <sup><a href=\"#src-51\">[51]<\/a><\/sup>. The scheme works like this <sup><a href=\"#src-51\">[51]<\/a><\/sup>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Calendly invites to Zoom or Teams arrive from hijacked accounts.<\/li>\n\n<li>The links lead to look-alike domains.<\/li>\n\n<li>The fake meeting replays the victim&#8217;s contacts&#8217; videos or deepfakes.<\/li>\n\n<li>A fake &#8220;fix your audio&#8221; prompt installs a cookie harvester, keylogger, screen capture and backdoor.<\/li>\n\n<li>The malware hijacks the victim&#8217;s Telegram, LinkedIn, Slack and Discord accounts.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The FBI also obtained a warrant covering more than 900 victim webcam videos. It is unclear whether FaceStealer was used in the Binance breach <sup><a href=\"#src-51\">[51]<\/a><\/sup>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Who is affected<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Gootloader affects two separate groups:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>people who downloaded and ran a lure, who need endpoint remediation<\/li>\n\n<li>operators of compromised WordPress sites, who need site remediation<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The takedown <strong>does not clean infected hosts<\/strong>. FaceStealer targets crypto, finance and executive staff who take external meeting invites.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Gootloader works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is background vendor research, not this week&#8217;s DOJ release, from Huntress <sup><a href=\"#src-49\">[49]<\/a><\/sup> and Red Canary <sup><a href=\"#src-50\">[50]<\/a><\/sup>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Lure:<\/strong> an SEO-poisoned, compromised WordPress site offers a legal-style document. DOJ says only &#8220;tricking users into downloading&#8221; <sup><a href=\"#src-47\">[47]<\/a><\/sup>.<\/li>\n\n<li><strong>Download:<\/strong> the download triggers a POST to <code>\/wp-comments-post.php<\/code>, which returns an XOR-encrypted ZIP.<\/li>\n\n<li><strong>Execution:<\/strong> the ZIP holds a JavaScript file masquerading as jQuery. It runs through <code>wscript<\/code>, then <code>cscript<\/code>, then PowerShell.<\/li>\n\n<li><strong>Persistence:<\/strong> older variants used scheduled tasks. Newer ones use a Startup-folder <code>.LNK<\/code> with 8.3 short names.<\/li>\n\n<li><strong>Follow-on:<\/strong> the Supper SOCKS5 backdoor (Vanilla Tempest), Kerberoasting, <code>nltest<\/code>, domain-controller access within about 17 hours (or under 1 hour in one case), NTDS.dit dumping and log clearing <sup><a href=\"#src-49\">[49]<\/a><\/sup>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">What defenders should look for<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">These come from Red Canary <sup><a href=\"#src-50\">[50]<\/a><\/sup> and Huntress <sup><a href=\"#src-49\">[49]<\/a><\/sup>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Script execution:<\/strong><ul><li><code>wscript.exe<\/code> with a command line containing an AppData <code>.js<\/code> path (for example <code>AppData\\Local\\Temp\\Temp1_&lt;name&gt;.zip<\/code>)<\/li><li><code>cscript.exe<\/code> running a <code>~1.js<\/code> 8.3 short name, which Red Canary calls &#8220;an uncommon pattern&#8221;<\/li><li>the chain <code>wscript<\/code> \u2192 <code>cscript<\/code> \u2192 PowerShell<\/li><\/ul><\/li>\n\n<li><strong>Persistence and staging:<\/strong><ul><li>second-stage files written as <code>.dat<\/code> or <code>.log<\/code> and renamed to <code>.js<\/code> in AppData\\Roaming<\/li><li>scheduled tasks named with two or three unrelated words that run AppData\\Roaming scripts<\/li><li>staging folders that mimic Teams, Zoom, FortiClient, Adobe or UltraVNC<\/li><li>registry keys under <code>HKCU\\SOFTWARE\\Microsoft\\Phone|Personalization|Fax\\%USERNAME%<\/code><\/li><\/ul><\/li>\n\n<li><strong>Historical C2<\/strong> (Huntress, Nov 2025): <code>103.253.42[.]91<\/code>, <code>178.32.224[.]219<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>False positives:<\/strong> legitimate admin scripts run through <code>wscript<\/code>, but rarely from ZIP temp paths.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>For FaceStealer:<\/strong> look for meeting links to non-vendor domains, and for any &#8220;audio driver&#8221; or &#8220;fix&#8221; installer run straight after a call.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to investigate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Watch for Shadowserver notifications. Hunt for both older and newer Gootloader persistence. If you find any, scope Kerberoasting and DC access straight away, given the fast escalation timelines above <sup><a href=\"#src-49\">[49]<\/a><\/sup>. On WordPress hosts, compare core, plugin and theme files with trusted originals and look for rogue admin users.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Contain and remediate (in order)<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Isolate hosts showing execution evidence.<\/li>\n\n<li>Reset credentials, prioritising service accounts exposed to Kerberoasting.<\/li>\n\n<li>Rebuild compromised WordPress sites from trusted code.<\/li>\n\n<li>For FaceStealer victims, revoke sessions and tokens on every messaging platform, and move crypto to new wallets.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Verify recovery<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm no persistence remains in Startup, scheduled tasks or the registry keys above. Confirm site files match trusted originals.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prevention and awareness<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Teach staff to get templates from known sources rather than search results, and to treat any meeting that asks them to install something as hostile. See the awareness lesson in section 8.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>No command panels.<\/em> No official command documentation is cited.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related on MAG212 CYBER<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyber.mag212.com\/the-keys-were-already-inside-mag212-cyber-weekly-november-14-2026\/\">MAG212 CYBER Weekly, 14 November 2026: The keys were already inside<\/a> (full issue and PDF)<\/li>\n\n<li><a href=\"https:\/\/cyber.mag212.com\/subscribe-free\/\">Subscribe free to MAG212 CYBER<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><span id=\"src-47\">[47]<\/span> US Department of Justice, &#8220;Gootloader malware disrupted in international cyber operation (Press Release 26-1351)&#8221;, 12 Nov 2026. <a href=\"https:\/\/www.justice.gov\/opa\/pr\/gootloader-malware-disrupted-international-cyber-operation\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-48\">[48]<\/span> The Record, &#8220;Gootloader: DOJ details takedown&#8221;, 13 Nov 2026. <a href=\"https:\/\/therecord.media\/gootloader-ransomware-doj-details\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-49\">[49]<\/span> Huntress, &#8220;Gootloader threat detection: WOFF2 obfuscation (background)&#8221;, Nov 2025. <a href=\"https:\/\/www.huntress.com\/blog\/gootloader-threat-detection-woff2-obfuscation\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-50\">[50]<\/span> Red Canary, &#8220;Threat Detection Report: Gootloader (background)&#8221;, Undated. <a href=\"https:\/\/redcanary.com\/threat-detection-report\/threats\/gootloader\/\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-51\">[51]<\/span> The Record, &#8220;Stolen Binance crypto recovered; DOJ disrupts FaceStealer&#8221;, 12 Nov 2026. <a href=\"https:\/\/therecord.media\/stolen-binance-crypto-recovered-doj-facestealer-disrupted\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Written and edited by El Mostafa Ouchen for MAG212 CYBER. Facts checked against the sources above as of 14 November 2026, 10:05 AM PST. Diagrams are original MAG212 CYBER illustrations.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Law enforcement disrupted Gootloader&#8217;s server network while DOJ targeted North Korea-linked Binance-theft funds and the FaceStealer fake-meeting malware.<\/p>","protected":false},"author":1,"featured_media":4262,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,16,15],"tags":[375,353,298,351,24],"class_list":["post-4287","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-incidents","category-ransomware","category-threat-intelligence","tag-doj","tag-gootloader","tag-malware","tag-operation-endgame","tag-ransomware"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4287"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4287\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4262"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}