-
US Justice Department dismantles Gootloader malware network linked to at least 25,000 computer infections worldwide since 2018.
-
More than 100 compromised servers, including WordPress websites, cleansed of malware as US domain names used by cybercriminals are seized.
-
Malware linked to ransomware attacks against at least 44 US victims, resulting in estimated losses of $28.8 million.
-
FBI, US military investigative agencies, Europol and law enforcement authorities from Europe, Canada and Australia participate in multinational crackdown.
November 13, (THEWILL) – The United States Department of Justice has dismantled an international cybercrime network responsible for infecting at least 25,000 computers worldwide with Gootloader malware, which has been used to facilitate ransomware attacks resulting in approximately $28.8 million in losses.
The department announced on Thursday that the operation led to the removal of the malicious software from more than 100 computer servers, including compromised WordPress websites, and the seizure of US domain names used by cybercriminals to distribute and control the malware.
Gootloader, which has been active since at least 2018, was used to compromise computer systems across different countries and provide ransomware operators with access to victims’ networks.
According to the Justice Department, the malware has been linked to ransomware attacks against at least 44 US-based victims, resulting in estimated financial losses of $28.8 million.
The operation was conducted under court authorisation by the Justice Department and the Federal Bureau of Investigation (FBI), in collaboration with international law enforcement agencies and private-sector organisations.
Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said the operation had disrupted the digital infrastructure used by cybercriminals to distribute malware and facilitate ransomware attacks.
“With court authorisation, the Department of Justice and FBI, along with our international partners, conducted an online operation that liberated over 100 servers from malicious software, denying ransomware criminals a platform,” Duva said.
He said the operation also advanced President Donald Trump’s Cyber Strategy by targeting the infrastructure supporting criminal activities.
US Attorney Peter McNeilly for the District of Colorado described the operation as an example of the importance of international cooperation in tackling cybercrime, noting that criminal networks frequently operate across national boundaries.
“Cybercrime knows no borders and this case is an excellent example of international partnerships working to protect people around the world,” McNeilly said.
He commended the participating agencies and their partners for their efforts in identifying and disrupting the network.
Gootloader Targeted US Military, Defence Industry
The Department of War’s Office of Inspector General disclosed that Gootloader had targeted victims globally, including the US Department of War and the Defense Industrial Base.
Special Agent in Charge Kenneth DeChellis of the Defense Criminal Investigative Service (DCIS) Cyber Field Office said the malware’s reach extended beyond ordinary computer users to institutions connected to the US defence sector.
“The Gootloader malware targeted victims on a global scale, including attacks on the U.S. Department of War and the Defense Industrial Base,” DeChellis said.
He said the operation demonstrated the longstanding partnership and shared commitment between international law enforcement agencies and private-sector organisations in pursuing cyber threats.
FBI Cyber Branch Operations Director Brett Leatherman said Gootloader exploited compromised websites to infect computers worldwide and provide cybercriminals with access to deploy ransomware.
“Using a network of compromised websites, Gootloader malware infected thousands of computers worldwide, providing cybercriminals with access to deploy ransomware and cause millions of dollars in losses,” Leatherman said.
He said the coordinated operation involved disrupting the botnet through technical measures, notifying affected victims and assisting with the removal of the malware from compromised systems.
Leatherman attributed the success of the operation to cooperation between international law enforcement agencies and private-sector partners, which he said helped protect victims from further harm and prevent additional exploitation.
Director L. Scott Moreland of the Department of the Army Criminal Investigation Division also described the operation as evidence of the effectiveness of coordinated international law enforcement action against cybercrime.
“Dismantling the Gootloader malware and botnet, which infected over 25,000 systems worldwide, demonstrates the power of unified, international law enforcement operations,” Moreland said.
He said the Army Criminal Investigation Division remained committed to working with global partners to confront cybercriminals, adding that disrupting criminal networks could stop ransomware attacks before they take hold.
READ ALSO:
How Cybercriminals Used Gootloader
According to court warrants unsealed this week, Gootloader is malware that infects computers through various methods, often by tricking unsuspecting individuals into downloading malicious files.
Once a computer is infected, it becomes part of a network of compromised computers known as a botnet.
The cybercriminals behind Gootloader used the botnet to infect additional computers before selling access to the compromised systems to ransomware operators.
The arrangement enabled other criminal groups to gain entry into victims’ computer networks and deploy ransomware, exposing individuals and organisations to financial losses and disruption of their operations.
The Justice Department said the latest operation targeted the infrastructure supporting the malware, removing it from more than 100 servers and seizing US domain names used by the criminal operators.
Europol, FBI, Other Agencies Join International Operation
The operation was conducted in coordination with Operation Endgame, a multinational law enforcement initiative targeting the dismantling of malware distribution networks and the criminal services supporting them.
The Gootloader investigation was led by the DCIS, the FBI’s Denver Field Office, and the US Army Criminal Investigation Division.
Other participating agencies included Germany’s Federal Criminal Police Office (BKA), the Netherlands National Police’s National High Tech Crime Unit, the Royal Canadian Mounted Police, Ottawa Police Service, Danish Police, France’s Paris Cybercrime Unit, the United Kingdom’s National Crime Agency, the Australian Federal Police and Europol.
Technical assistance was also provided by ICHIP The Hague, Fraunhofer FKIE, Registrar of Last Resort (RoLR), OpenAI and Sharktech Inc. The Justice Department’s Office of International Affairs also assisted in the investigation.
US Secures Over 220 Cybercrime Convictions Since 2020
The Justice Department said its Computer Crime and Intellectual Property Section investigates and prosecutes cybercrime and intellectual property offences in collaboration with domestic and international law enforcement agencies, often with assistance from private-sector organisations.
Since 2020, the unit has secured the convictions of more than 220 cybercrime and intellectual property offenders and obtained court orders for the return of more than $500 million in funds to victims.
The department also provides technical assistance to foreign law enforcement agencies, prosecutors and judicial institutions through its International Computer Hacking and Intellectual Property (ICHIP) programme.
The programme is jointly administered by CCIPS and the Criminal Division’s Office of Overseas Prosecutorial Development, Assistance and Training (OPDAT), in partnership with the US Department of State’s Bureau of International Narcotics and Law Enforcement Affairs.
Felix Ifijeh is a journalist with years of professional reporting experience. Known for his keen news sense, compelling storytelling and commitment to accurate, impactful reporting, he has built a reputation for turning leads into clear, engaging, and well-structured reports that resonate with readers. His work reflects deep newsroom experience and a commitment to accurate, impactful journalism.