Authorities Disrupt Gootloader Network Across More Than 100 Servers
An international law enforcement operation dismantled malware infrastructure that infected at least 25,000 systems and provided initial access for ransomware attacks.
- By Chelsey Arries
- Nov 13, 2026
An international law enforcement operation has removed Gootloader malware from more than 100 servers, including compromised WordPress sites, and seized U.S. domains used to distribute and control the threat, the Justice Department announced.
Active since 2018, Gootloader has infected at least 25,000 computers worldwide and was used in ransomware attacks against at least 44 U.S.-based victims, resulting in about $28.8 million in losses. Targeted entities included the U.S. Department of War and the Defense Industrial Base.
According to unsealed warrants, Gootloader spreads by tricking unsuspecting users into downloading malicious files. Operators linked infected machines into a botnet, used that network to compromise additional systems and sold access to those targets to ransomware groups.
Alongside the seizures, the Shadowserver Foundation worked with internet service providers and computer security incident response teams to identify infected systems, notify victims and assist with remediation.
The FBI’s Denver Field Office, the Defense Criminal Investigative Service and the Army Criminal Investigation Division led the investigation alongside overseas partners under Operation Endgame, a multinational initiative targeting cybercriminal malware services.
About the Author
Chelsey Arries is assistant editor of Security Today, Campus Security Today, Occupational Health & Safety and Environmental Protection Online.