US authorities have seized domestic domains and removed Gootloader malware from more than 100 servers in a court-authorised international operation aimed at disabling infrastructure used to provide ransomware operators with access to compromised computers.
The Justice Department announced the action on 12 November, after warrants connected with the operation were unsealed. Gootloader commonly reaches victims through apparently legitimate but compromised websites, including WordPress sites, and turns infected computers into part of a botnet. Access to those machines can then be sold to other criminal groups.
Authorities estimate that Gootloader has infected at least 25,000 computers worldwide since 2018. The malware was used in ransomware attacks against at least 44 US victims, producing losses of about $28.8 million, according to the department. The identified targets also included defence-related systems.
The action combined judicial process with technical remediation. The Federal Bureau of Investigation, defence investigative agencies and international partners removed malicious software, seized the domains used to deliver and control it, notified victims and worked with internet-service providers and incident-response teams to help clean infected systems.
The investigation was coordinated with Germany, the Netherlands, Canada, Denmark, France, the United Kingdom and Australia, as well as Europol. It formed part of Operation Endgame, the continuing multinational effort against malware services.
The disruption does not itself determine criminal liability, and the Justice Department’s announcement did not identify a newly charged defendant. It is principally an infrastructure action: the immediate legal effect lies in the court-approved removal and seizure measures, while the related investigation and any prosecution remain separate.
The official account of the warrants and technical operation is in the Justice Department release.
