U.S. Justice Department disrupts Gootloader malware network in global cyber operation

Traders Union
All News
Regulators
Justice disrupts gootloader network

Highlights

U.S. Department of Justice-led operation dismantles Gootloader malware from over 100 servers and seizes U.S. domains used for delivery and control.
Gootloader has infected at least 25,000 computers worldwide since 2018 and linked to ransomware attacks causing about $28.8 million in losses for at least 44 U.S. victims.
Investigation involved international cooperation through Operation Endgame with law enforcement from Germany, UK, France, Europol, and financial and technical support from multiple cybersecurity organizations.

International takedown targets botnet infrastructure

As reported by U.S. Department of Justice, the operation removes Gootloader malware from more than 100 servers, including compromised WordPress sites, and seizes U.S. domain names used to deliver and control the malware.

Officials say Gootloader spreads by tricking victims into downloading malicious files, after which infected devices are added to a botnet. The operators then use that network to infect additional computers and sell access to those systems to ransomware actors, according to warrants unsealed this week.

The Justice Department says the action is carried out with court authorization alongside the FBI and international partners. It adds that visitors to seized domains now see a seizure banner, while the Shadowserver Foundation works with internet service providers and Computer Security Incident Response Teams to identify infected systems, notify victims and support remediation.

Ransomware losses and cross-border cooperation

Since 2018, Gootloader has infected at least 25,000 computers globally and has been used in ransomware attacks affecting at least 44 U.S.-based victims, causing about $28.8 million in losses, according to the department.

The investigation is led by the Defense Criminal Investigative Service, the FBI's Denver Field Office and the Army Criminal Investigation Division, working with agencies in Germany, the Netherlands, Canada, Denmark, France, the UK, Australia and Europol. The action is also coordinated with Operation Endgame, a multinational law enforcement initiative focused on dismantling malware services used by cybercriminals.

The department says technical support also comes from organizations including ICHIP the Hague, Fraunhofer FKIE, Registrar of Last Resort, OpenAI and Sharktech. Prosecutors in the case include Senior Counsel Thomas Dougherty of the Criminal Division's Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Jasand Mock for the District of Colorado.

We have also looked at global cybersecurity funding trends, including larger late-stage rounds even as deal counts fell.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.