- The Justice Department removed Gootloader from more than 100 servers and seized U.S. domains.
- Gootloader infected at least 25,000 computers worldwide since 2018.
- The malware was used in ransomware attacks against at least 44 U.S. victims, causing approximately $28.8 million in losses.
The Justice Department and international partners disrupted Gootloader malware infrastructure on Nov 12, 2026, removing the malware from more than 100 computer servers and seizing U.S. domains used by criminals.
The operation reached compromised WordPress sites and other servers used to deliver and control Gootloader. The malware infected at least 25,000 computers worldwide since 2018, and it was used in ransomware attacks against at least 44 U.S. victims that caused approximately $28.8 million in losses.
Gootloader infected victims by tricking them into downloading the malware and then adding their computers to a botnet. Its operators used that botnet to infect other computers and sell access to later-infected systems to ransomware actors.
On this page
Gootloader operators sold access to infected computers
According to warrants unsealed this week, Gootloader often reached victims by tricking them into downloading it. Once installed, it added compromised computers to a botnet.
FBI operation combined technical work with victim notifications
A. Tysen Duva said the Justice Department, FBI and international partners conducted the operation with court authorization.
Brett Leatherman said Gootloader used a network of compromised websites to infect thousands of computers and give criminals access to deploy ransomware.
Gootloader takedown formed part of Operation Endgame
The Record said earlier Operation Endgame actions targeted DanaBot, IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee and Trickbot. It also reported takedowns involving the Rhadamanthys infostealer, VenomRAT remote access trojan and Elysium botnet.
The Justice Department said Shadowserver worked with internet service providers and Computer Security Incident Response Teams to identify infected systems, notify victims and assist with remediation.
The operation was coordinated with Operation Endgame, a multinational law enforcement initiative targeting malware cybercriminal services.
FAQ
What happened to Gootloader?
The Justice Department and international partners removed Gootloader from more than 100 computer servers and seized U.S. domains used to deliver and control the malware on Nov 12, 2026.
How many computers did Gootloader infect?
The Justice Department said Gootloader infected at least 25,000 computers worldwide since 2018.
Was Gootloader used in ransomware attacks?
Yes. The Justice Department said it was used in ransomware attacks against at least 44 U.S. victims, causing approximately $28.8 million in losses.
How did Gootloader infect computers?
It often tricked people into downloading the malware, then added their computers to a botnet. Its operators used the botnet to infect other computers and sell access to ransomware actors.
Who helped disrupt Gootloader?
The Justice Department and FBI worked with international partners, while Shadowserver worked with internet service providers and Computer Security Incident Response Teams to identify infected systems, notify victims and assist remediation.
Sources
How we checked this story
| Claim | Source | Status |
|---|---|---|
| The Justice Department removed Gootloader from over 100 computer servers, including compromised WordPress sites, and seized U.S. domains. | U.S. Department of Justice | Confirmed |
| Since 2018, Gootloader infected at least 25,000 computers worldwide. | U.S. Department of Justice | Confirmed |
| Gootloader was used in ransomware attacks against at least 44 U.S. victims, causing approximately $28.8 million in losses. | U.S. Department of Justice | Confirmed |
| The operation was conducted with court authorization by the Justice Department, FBI and international partners. | A. Tysen Duva | Attributed |
| Brett Leatherman said gootloader used compromised websites to infect thousands of computers and provide criminals access to deploy ransomware. | Brett Leatherman | Attributed |
| Gootloader infected victims by tricking unsuspecting individuals into downloading it, then added compromised computers to a botnet. | U.S. Department of Justice | Confirmed |
| Gootloader operators used the botnet to infect other computers and sell access to later-infected computers to ransomware actors. | U.S. Department of Justice | Confirmed |
| Shadowserver worked with internet service providers and CSIRTs to identify infected systems, notify victims and assist remediation. | U.S. Department of Justice | Confirmed |
| The operation was coordinated with Operation Endgame, a multinational initiative targeting malware cybercriminal services. | U.S. Department of Justice | Confirmed |
| The Record said the Justice Department said it removed Gootloader from more than 100 servers and seized domains used to deliver and control the malware. | The Record | Attributed |
| Kenneth DeChellis said gootloader targeted victims globally, including attacks on the U.S. Department of War and the Defense Industrial Base. | Kenneth DeChellis, via The Record | Attributed |
| The Record said previous Operation Endgame actions targeted DanaBot, IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee and Trickbot. | The Record | Attributed |
| The Record said operation Endgame also took down the Rhadamanthys infostealer, VenomRAT remote access trojan and Elysium botnet. | The Record | Attributed |
| The Record said the Justice Department previously partnered with other agencies to take down AVCheck.net, Crypt.guru, Cryptor.live and Cryptor.biz. | The Record | Attributed |
| justice.gov published its report on Nov 12, 2026. | justice.gov | Confirmed |
Could not verify
- Whether Gootloader was exploited after the takedown is not established
- Whether the 44 U.S. victims represent all ransomware victims is not established
- Whether the reported attacks on the Department of War and Defense Industrial Base involved confirmed infections is not established
- Whether the seized domains and servers remain under law enforcement control is not established
Related stories
Vulns & PatchesCitrix discloses critical NetScaler zero-days after exploitation reports
Data LeaksArara email service breach exposed more than 1 million Osaka addresses
Data LeaksMaersk data extraction from acquired legacy system under investigation