DOJ and FBI dismantle Gootloader network across 100 servers

The US Department of Justice and FBI, working with international partners, removed Gootloader malware from more than 100 servers and seized US domains used to control the network. The operation, authorised by a court in the District of Colorado, included servers running hijacked WordPress websites. According to unsealed court warrants, the operators used compromised sites to trick visitors into downloading malicious files; infected computers were then added to a global botnet, with access sold to ransomware gangs.

Authorities said Gootloader had infected more than 25,000 computers worldwide since 2018 and was linked to 44 ransomware attacks in the United States, causing about US$28.8 million in claimed losses. The Defense Criminal Investigative Service said victims included the US Department of War and the Defense Industrial Base. Individual suspects have not been named.

The operation was part of the multinational Operation Endgame, involving Europol and police agencies in Germany, the Netherlands, Canada, Denmark, France, the United Kingdom and Australia. The Shadowserver Foundation worked with internet service providers and national incident response teams to notify affected owners. The article advises website administrators to check WordPress installations for unauthorised scripts, update vulnerable plugins and respond to any Shadowserver notifications.