A StealC backend I reported in April still exposes its documented malware routes after Operation Endgame

In April, I analyzed a StealC v2 campaign distributed through 19 GitHub typosquat repositories. One of the repositories impersonated my own open-source project.

The delivery chain was:

GitHub typosquat -> Python dropper -> api.nailproxy.space -> encrypted Windows loader -> StealC v2 DLL -> spellmarketplace.club / 62.60.226.113:6673 

GitHub eventually removed all 19 repositories.

I separately reported the backend indicators to the relevant registrars, Cloudflare, the hosting provider, CERT-Bund, GitHub Security Lab, ThreatFox, and AlienVault OTX.

Then Operation Endgame disrupted infrastructure associated with SocGholish, Amadey, and StealC. Europol reported 326 servers and 142 domains actioned, while Microsoft said it moved against more than 200 malicious Amadey and StealC C2 domains and IPs.

Three months after my original disclosure, I checked the known infrastructure again using only minimal unauthenticated GET/HEAD requests.

The two malware-specific routes still behave differently from an arbitrary control path:

GET /api/v1/auth/session -> 405 Method Not Allowed GET /api/v1/data/sync -> 405 Method Not Allowed GET /foo/bar/baz -> 404 Not Found 

HEAD produces the same status codes for these three paths.

My interpretation is deliberately narrow:

• The known application routes remain registered and reachable.
• This does not prove that payload delivery, authentication, or exfiltration still works.
• I did not send the HMAC handshake, trigger Stage 2, or interact with the malware protocol.

There was another odd result: on both spellmarketplace.club/ and the bare IP root path, GET returned 404 while HEAD returned 200 at the same moment. I therefore do not treat the root-path checks as reliable evidence that the complete backend is operational.

The monitoring evidence also has limitations. A daily cron produced only 18 measurements over 69 days, with gaps of up to 20 days. The delivery and exfiltration endpoints also briefly became unreachable in late May. I included those details rather than presenting the infrastructure as continuously available.

The useful distinction for me is:

A large operation can successfully disrupt hundreds of malicious systems while a specific previously reported backend still exposes its known routes.

The full write-up includes the original kill chain, reporting timeline, ThreatFox/OTX submissions, current probe results, and the limits of what can be concluded without actively engaging the malware protocol: