Gootloader Malware DisrupGootloader Malware Disrupted in International Cyber Operationted in International Cyber Operation

The Department of Justice today announced the successful removal of malware known as "Gootloader" from over 100 computer servers, including compromised WordPress sites, and the seizure of U.S. domain names used by criminals to deliver and control the Gootloader malware. Since 2018, Gootloader malware has infected at least 25,000 computers around the world. Gootloader malware has been used in ransomware attacks of at least 44 U.S. based victims which has resulted in approximately $28.8 million in loss.

"With court authorization, the Department of Justice and FBI, along with our international partners, conducted an online operation that liberated over 100 servers from malicious software, denying ransomware criminals a platform," said Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division. "The Department of Justice has, once again, advanced President Trump's Cyber Strategy by disrupting criminals' cyber infrastructure."

"Cybercrime knows no borders and this case is an excellent example of international partnerships working to protect people around the world," said U.S. Attorney Peter McNeilly for the District of Colorado. "I am proud of the role we played in disrupting this botnet and thank our partners for their exceptional work to unearth this complex network."

"The Gootloader malware targeted victims on a global scale, including attacks on the U.S. Department of War and the Defense Industrial Base," said Special Agent in Charge Kenneth DeChellis of the Department of War, formerly known as the Department of Defense, Office of Inspector General Defense Criminal Investigative Service (DCIS), Cyber Field Office. "This announcement is a testament to the long-standing partnership and shared resolve between international law enforcement and private-sector organizations in pursuing cyber threats."

"Using a network of compromised websites, Gootloader malware infected thousands of computers worldwide, providing cybercriminals with access to deploy ransomware and cause millions of dollars in losses," said Operations Director Brett Leatherman of the FBI Cyber Branch. "Working alongside our partners, we disrupted the Gootloader botnet through coordinated technical operations, victim notifications, and remediation. Strong international and private-sector partnerships made this disruption possible, allowing us to protect victims from further harm and prevent future exploitation."

"Dismantling the Gootloader malware and botnet, which infected over 25,000 systems worldwide, demonstrates the power of unified, international law enforcement operations," said Director L. Scott Moreland, Department of the Army Criminal Investigation Division. "Alongside our global partners, Army CID is committed to taking the fight directly to cybercriminals. While disrupting these criminal networks stops ransomware attacks before they can take root, true cyber resilience relies on a combination of global law enforcement action and everyday personal vigilance."

According to warrants unsealed this week, Gootloader is malware that infects victim computers through a variety of means, often by tricking unsuspecting individuals into downloading it. Once infected, the compromised computers are added to a network of other compromised computers known as a botnet. The actors behind Gootloader used the botnet to infect other computers, then sell access to those later-infected computers to ransomware actors.

In addition to the law enforcement seizures, the Shadowserver Foundation assisted by working with internet service providers and Computer Security Incident Response Teams (CSIRTs) to identify infected systems, aid in notifying victims and assisting in remediation. Visitors to the seized domains will see the following seizure banner:

These actions were conducted in coordination with Operation Endgame, a multinational law enforcement initiative targeting the dismantling of malware cybercriminal services. More information regarding Operation Endgame can be found at www.operation-endgame.com.

The Gootloader investigation was led by DCIS, FBI's Denver Field Office and the Army Criminal Investigative Division, working closely with Germany's Bundeskriminalamt (BKA), the Netherlands National Police's National High Tech Crime Unit, Canada's Royal Canadian Mounted Police and Ottawa Police Service, Danish Police, Brigade de Lutte contre la cybercriminalité (Paris Cybercrime Unit), United Kindom's National Crime Agency, the Australian Federal Police and Europol. ICHIP the Hague, Fraunhofer FKIE, Registrar of Last Resort (RoLR), OpenAI and Sharktech, Inc. also provided valuable technical assistance to the investigation.

Senior Counsel Thomas Dougherty of the Criminal Division's Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Jasand Mock for the District of Colorado are prosecuting the case. The Justice Department's Office of International Affairs also provided valuable assistance.

CCIPS investigates and prosecutes cybercrime and intellectual property (IP) crime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 220 cyber and IP criminals, and court orders for the return of over $500 million in victim funds.

The Justice Department is providing IP and cybercrime technical assistance to foreign law enforcement, prosecutorial, and judicial partners in other countries through the ICHIP program. The Criminal Division's ICHIP Program is jointly administered by the Criminal Division's Office of Overseas Prosecutorial Development, Assistance and Training (OPDAT) and CCIPS through partnership between the U.S. Department of State's Bureau of International Narcotics and Law Enforcement Affairs.