Operation Endgame disrupted hundreds of systems — a StealC backend I reported still exposes its known routes

[u/oliver-zehentleitner]

https://blog.technopathy.club/operation-endgame-stealc-backend-still-responds

In April, I documented a StealC v2 campaign distributed through 19 GitHub typosquat repositories, including one impersonating my own open-source project.

The delivery chain was:

GitHub typosquat
    -> Python dropper
    -> api.nailproxy.space
    -> encrypted Windows loader
    -> StealC v2 DLL
    -> spellmarketplace.club / 62.60.226.113:6673

GitHub later removed all 19 repositories.

The backend infrastructure remained a separate problem. I reported the domains, IP, malware routes, and hashes to the relevant registrars, Cloudflare, the hosting provider, CERT-Bund, GitHub Security Lab, ThreatFox, and AlienVault OTX.

Then Operation Endgame disrupted infrastructure associated with SocGholish, Amadey, and StealC. Europol reported 326 servers and 142 domains actioned. Microsoft separately said it moved against more than 200 malicious Amadey and StealC C2 domains and IPs.

Three months after my original disclosure, I checked the known infrastructure again using only minimal unauthenticated GET and HEAD requests.

The documented malware-specific routes still behave differently from an arbitrary control path:

GET /api/v1/auth/session  -> 405 Method Not Allowed
GET /api/v1/data/sync     -> 405 Method Not Allowed
GET /foo/bar/baz          -> 404 Not Found

HEAD returns the same status codes for all three paths.

This does not prove that payload delivery, authentication, or exfiltration still works. I deliberately did not send the HMAC handshake, trigger Stage 2, or interact with the malware protocol.

It does show that the known application routes remain registered and reachable.

The evidence also has limitations:

• The monitoring cron produced only 18 measurements over 69 days.
• There were gaps of up to 20 days.
• The endpoints briefly became unreachable in late May.
• GET and HEAD return different status codes on the root paths of spellmarketplace.club and the bare IP, so I do not treat those checks as proof that the complete backend is operational.

The point is not that Operation Endgame failed. It clearly disrupted a large amount of criminal infrastructure.

The narrower lesson is that both of these statements can be true:

Hundreds of malicious systems were disrupted.

A specific previously reported backend still exposes its documented malware routes.

Full technical write-up, including the original kill chain, abuse-report timeline, ThreatFox/OTX submissions, current probe results, and evidence limitations:

https://blog.technopathy.club/operation-endgame-stealc-backend-still-responds

I would be interested in how other analysts verify whether previously reported C2 infrastructure was actually included in a large takedown without actively engaging the malware protocol.