Law enforcement disrupts Gootloader after 25,000 infections

International law enforcement has disrupted the Gootloader malware operation, removing the software from more than 100 computer servers and seizing US domain names used to deliver and control the botnet. The Department of Justice, in coordination with the Defence Criminal Investigative Service, FBI Denver, Army CID and international partners, announced that since 2018 Gootloader infected at least 25,000 computers worldwide.

Victims were spread across multiple countries, with the DoJ noting that Gootloader has been used in ransomware campaigns that impacted at least 44 U.S.-based victims and resulted in around $28.8 million in losses. The operation involved compromised WordPress sites among the infection vectors, and the malware operates as an access-as-a-service platform that sells compromised machines to ransomware groups.

The legal action, conducted under court authority as part of Operation Endgame, also benefited from technical assistance from the Shadowserver Foundation, hosting providers, and national security entities. Gootloader’s modus operandi has included botnet-driven distribution and the deployment of additional payloads such as ransomware, information-stealing tools, and other malware components, sometimes employing fileless techniques.

The Shadowserver Foundation helped identify infected machines and inform victims, while visitors to seized domains now see law enforcement seizure banners. The release quotes remarks from Army CID’s Director L. Scott Moreland on the value of international cooperation in dismantling the Gootloader network, and highlights that the combined actions aim to curb ransomware by disrupting criminal services linked to the botnet. Further details on Operation Endgame are available through official channels.