CRITICAL: CastleRAT Historical Bot Infections Special Report

LAST UPDATED: 2026-11-12

DEFAULT SEVERITY LEVEL: CRITICAL

The data in this Special Report is being shared as an output of the continuing international Law Enforcement cyber crime disruption effort called Operation Endgame, which had a fourth season of action announced on November 12th 2026. This Special Report dated 2026-11-12 contains data likely stolen by the CastleRAT information stealer malware during an undefined time period. You can read more about the CastleRAT disruption operation here.

Shadowserver Special Reports are unlike all of our other standard free daily network reports. They do not cover a specific daily 24-hour time period.

Instead, we send out Special Reports in situations where we are able to share one-time, high value datasets that we feel should be reported responsibly for maximum public benefit. Sometimes there are incidents when it would be useful to be able to notify potential victims about events or breaches that may have impacted them outside of the previous 24-hour period, when it may take a number of days for incident responders to conduct forensic investigations and analyzed data becomes available for sharing with potential victims. Although the events included in these Special Reports will fall outside of our usual 24-hour daily reporting window, we believe that there would still be significant benefit to our constituents in receiving and, hopefully, acting on the retrospective data.

If you have missed a Special Report because you were NOT yet a subscriber at the time a report was pushed out, simply subscribe for your network now and specifically request all recent Shadowserver Special Reports – and we will regenerate them specifically for your network, at no cost.

Note that the data shared across Special Reports may differ on a case by case basis, hence the report formats for individual Special Reports may be different.

The data in this CastleRAT Historical Bot Infections Special Report was provided to Shadowserver by the Operation Endgame Law Enforcement partners to disseminate to National CERTs/CSIRTs and network owners globally, to maximize remediation efforts.

Note that exact timestamps were not available for individual events, so the timestamp field is set “2026-11-12 00:00:00”. Since no first and last seen time for an infection was provided, no date range when an infection was likely active is included in the Special Report data.

This Special Report has severity level CRITICAL set on all events.  Severity levels are described here.

Filename prefix: 2026-11-12-special. Note: this is accessible in the API using 2026-11-12 as the search date.

Fields

  • timestamp
    The timestamp has been set to "2026-11-12 00:00:00", to represent when this one-off data set was distributed.
  • ip
    IP address of the website associated with the compromised credentials.
  • port
    TCP or UDP port of the website associated with the compromised credentials.
  • protocol
    Protocol used by the website associated with the compromised credentials.
  • asn
    Autonomous System Number of the website associated with the compromised credentials.
  • geo
    Country of the website associated with the compromised credentials.
  • region
    Region of the website associated with the compromised credentials.
  • city
    City of the website associated with the compromised credentials.
  • hostname
    Hostname of the website associated with the compromised credentials.
  • naics
    North American Industry Classification System Code
  • sector
    Sector of the website associated with the compromised credentials.
  • tag
    Additional tags for more insight.
  • infection
    Description of the malware/infection.
  • public_source
    Source of the data.
  • status
    Status of the system associated with the compromised credentials, for example, "infected" (data was historically stolen by the CastleRAT malware).
  • detail
    URL to obtain more detail.
  • account
    The user name associated with the compromised credentials captured by the CastleRAT information stealing malware.
  • method
    Request method (unused).
  • severity
    Severity level.
  • hostname_source
    Hostname source.
  • first_seen_time
    First seen time (unused).
  • last_seen_time
    Last seen time (unused).
  • potential_exposure_time
    Potential exposure time (unused).
  • url
    The URL associated with the compromised credentials captured by the CastleRAT information stealing malware.
  • password
    The password captured by the CastleRAT information stealing malware, redacted with ****s for most characters (to allow local verification)
  • password_sha1
    The SHA1 hash of the password captured by the CastleRAT information stealing malware, redacted to the first half of the hash only (to allow local verification)
  • password_ntlm
    The Windows NTLM hash of the password captured by the CastleRAT information stealing malware, redacted to the first half of the hash only (to allow local verification)

Sample

timestamp,ip,port,protocol,asn,geo,region,city,hostname,naics,sector,tag,infection,public_source,status,detail,account,method,severity,hostname_source,first_seen_time,last_seen_time,potential_exposure_time,url,password,password_sha1,password_ntlm
2026-11-12 00:00:00,192.168.0.1,443,tcp,64512,ZZ,Region,City,node01.example.com,0,,,CastleRAT,operation-endgame,infected,https://operation-endgame.com/,Alice,,critical,ptr,,,,https://192.168.0.1/start,D******384,ff78a5493882a8c0,a0ca783ee72b0dc0
2026-11-12 00:00:01,192.168.0.2,443,tcp,64512,ZZ,Region,City,node02.example.com,0,,,CastleRAT,operation-endgame,infected,https://operation-endgame.com/,Pat,,critical,ptr,,,,https://192.168.0.2/ru,***00,709e2332973f289c,0cd694be4834ad07
2026-11-12 00:00:02,192.168.0.3,443,tcp,64512,ZZ,Region,City,node03.example.com,0,,,CastleRAT,operation-endgame,infected,https://operation-endgame.com/,Nancy,,critical,ptr,,,,https://192.168.0.3/register/thank-you,M********21!,eecf33f55d251a27,1e69669db6d95b90

Our 151 Report Types

« Back to Network Reporting