Office of Public Affairs | Gootloader Malware Disrupted in International Cyber Operation - Department of Justice (.gov)
The Department of Justice has successfully removed Gootloader malware from over 100 computer servers and seized U.S. domain names used by criminals to deliver the malware.
The operation targeted Gootloader, a malware that has infected at least 25,000 computers worldwide since 2018. The malware has been used in ransomware attacks against 44 U.S. victims, resulting in approximately $28.8 million in losses. The Department of Justice worked with international partners to remove the malware from compromised WordPress sites and other servers.
The malware typically infects victim computers through deceptive downloads, tricking unsuspecting individuals. Once compromised, these computers become part of a botnet that criminals use to infect other systems and sell access to ransomware actors.
With court authorization, the Department of Justice and FBI, along with our international partners, conducted an online operation that liberated over 100 servers from malicious software, denying ransomware criminals a platform.
Global Partnership
The investigation was led by the Department of War's DCIS, FBI's Denver Field Office, and the Army Criminal Investigation Division. They collaborated with law enforcement agencies from Germany, Netherlands, Canada, Denmark, France, United Kingdom, and Australia, along with Europol.
Private sector organizations including ICHIP the Hague, Fraunhofer FKIE, Registrar of Last Resort, OpenAI, and Sharktech provided valuable technical assistance. The Shadowserver Foundation worked with internet service providers and CSIRTs to identify infected systems and aid in victim notifications and remediation.
The operation was conducted as part of Operation Endgame, a multinational initiative targeting malware cybercriminal services. Visitors to the seized domains now see a seizure banner indicating the government's intervention.
Impact and Response
The Gootloader malware specifically targeted victims on a global scale, including attacks on the U.S. Department of War and the Defense Industrial Base. The disruption demonstrates the power of unified international law enforcement operations against cybercriminal networks.
The Justice Department's Computer Crime and Intellectual Property Section (CCIPS) is prosecuting the case, with assistance from the Office of International Affairs. CCIPS has secured over 220 cyber and IP criminal convictions since 2020 and recovered more than $500 million in victim funds.
Dismantling the Gootloader malware and botnet, which infected over 25,000 systems worldwide, demonstrates the power of unified, international law enforcement operations.
Future Prevention
While disrupting criminal networks prevents ransomware attacks before they can take root, officials emphasize that true cyber resilience requires a combination of global law enforcement action and personal vigilance.
The Justice Department provides technical assistance to foreign law enforcement partners through the ICHIP program, jointly administered with the State Department's Bureau of International Narcotics and Law Enforcement Affairs. This ongoing collaboration aims to strengthen international capabilities against cyber threats.
Related
