DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018
The Justice Department dismantled over 100 servers used by the Gootloader malware, disrupting a network that infected 25,000 devices globally since 2018.
On Thursday, an international coalition of law enforcement agencies and cybersecurity companies dismantled more than 100 servers used by the StealC password-stealing malware as part of a wider takedown that disrupted 235 servers and 257 domains also used by the Gootloader and CastleRAT malware strains.
Gootloader Operation Details
In a follow-up notice, Assistant Attorney General A. Tysen Duva said the Justice Department removed Gootloader from more than 100 servers, including compromised websites, and seized several domain names used to deliver and control the malware.
FBI Cyber Branch Operations Director Brett Leatherman explained that hackers used the network of compromised websites to infect thousands of computers with Gootloader, providing access needed to deploy ransomware.
The Gootloader malware targeted victims on a global scale, including attacks on the U.S. Department of War and the Defense Industrial Base.
Impact and Scope
Justice Department officials revealed that Gootloader has existed since 2018 and was used to infect 25,000 devices globally. In court documents, prosecutors said victims typically downloaded Gootloader accidentally, adding their compromised device to a botnet of infected computers.
The hackers then sold access to the network of devices to ransomware gangs. The DOJ reported more than 44 U.S.-based ransomware victims were initially infected by Gootloader — leading to a total of $28.8 million in losses.
Operation Endgame
The takedowns were part of Operation Endgame — a long-running international law enforcement initiative aimed at disrupting powerful malware strains and massive botnets. Previous operations targeted malware strains like DanaBot, IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee and Trickbot.
The Shadowserver Foundation worked with internet service providers and Computer Security Incident Response Teams globally to identify infected systems and notify victims. Compromised domains now carry a seizure banner. Last year, the Justice Department also partnered with other agencies to take down AVCheck.net, Crypt.guru, Cryptor.live and Cryptor.biz — sites used to test malware against real antivirus tools.
Related
