DOJ Removes Gootloader Malware from 100+ Servers, Seizes Criminal Domains
The Justice Department dismantled the Gootloader botnet, which infected 25,000 computers worldwide and caused $28.8M in U.S. losses since 2018.
Gootloader botnet dismantled in coordinated multinational law enforcement action
The U.S. Department of Justice has successfully removed the "Gootloader" malware from more than 100 compromised computer servers — including hijacked WordPress sites — and seized U.S. domain names that criminals used to distribute and control the malicious software. DOJ Justice News reports that since 2018 Gootloader has infected at least 25,000 computers globally, causing approximately $28.8 million in losses through ransomware attacks on at least 44 U.S.-based victims.
"With court authorization, the Department of Justice and FBI, along with our international partners, conducted an online operation that liberated over 100 servers from malicious software, denying ransomware criminals a platform," said Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division. "The Department of Justice has, once again, advanced President Trump's Cyber Strategy by disrupting criminals' cyber infrastructure."
U.S. Attorney Peter McNeilly for the District of Colorado called the case an example of international cooperation at scale. "Cybercrime knows no borders," McNeilly said. "I am proud of the role we played in disrupting this botnet and thank our partners for their exceptional work to unearth this complex network."
How Gootloader operated
According to warrants unsealed this week, Gootloader infects victim computers through several methods, frequently by tricking individuals into downloading the malware. Once a machine is compromised, it is added to a botnet — a network of infected computers controlled remotely by the criminals behind the operation. Those actors then sold access to the botnet's infected machines to ransomware groups, who deployed additional attacks.
The malware targeted a wide range of victims. Special Agent in Charge Kenneth DeChellis of the Defense Criminal Investigative Service (DCIS) Cyber Field Office noted that targets included the U.S. Department of the Army and the Defense Industrial Base. "This announcement is a testament to the long-standing partnership and shared resolve between international law enforcement and private-sector organizations in pursuing cyber threats," DeChellis said.
FBI Cyber Branch Operations Director Brett Leatherman described the disruption as a combination of technical operations, victim notifications, and remediation work. "Working alongside our partners, we disrupted the Gootloader botnet through coordinated technical operations," Leatherman said. "Strong international and private-sector partnerships made this disruption possible, allowing us to protect victims from further harm and prevent future exploitation."
International partners and private sector support
The Gootloader investigation was led by DCIS, the FBI's Denver Field Office, and the Army Criminal Investigation Division. International law enforcement agencies that contributed include Germany's Bundeskriminalamt (BKA), the Netherlands National Police's National High Tech Crime Unit, Canada's Royal Canadian Mounted Police and Ottawa Police Service, Danish Police, France's Brigade de Lutte contre la cybercriminalité (Paris Cybercrime Unit), the United Kingdom's National Crime Agency, the Australian Federal Police, and Europol.
Technical assistance was provided by ICHIP the Hague, Fraunhofer FKIE, Registrar of Last Resort (RoLR), OpenAI, and Sharktech, Inc. The Shadowserver Foundation also assisted by working with internet service providers and Computer Security Incident Response Teams (CSIRTs) to identify infected systems, notify victims, and support remediation efforts. Visitors to the seized domains now see a law enforcement seizure banner.
Director L. Scott Moreland of the Army Criminal Investigation Division emphasized that disrupting criminal infrastructure is only part of the equation. "While disrupting these criminal networks stops ransomware attacks before they can take root, true cyber resilience relies on a combination of global law enforcement action and everyday personal vigilance," Moreland said.
Operation Endgame
The Gootloader action was carried out as part of Operation Endgame, a multinational law enforcement initiative focused on dismantling malware-based cybercriminal services. Additional information on that broader initiative is available at www.operation-endgame.com.
The case is being prosecuted by Senior Counsel Thomas Dougherty of the Criminal Division's Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Jasand Mock for the District of Colorado. The Justice Department's Office of International Affairs provided additional assistance.
CCIPS, which investigates and prosecutes cybercrime and intellectual property offenses in coordination with domestic and international partners, has secured more than 220 convictions of cyber and IP criminals since 2020, along with court orders for the return of over $500 million in victim funds.
Source: DOJ Justice News