The U.S. Department of Justice announced on Thursday, November 12, that investigators have removed the Gootloader malware from more than 100 computer servers, including compromised WordPress websites, and seized U.S. domain names that criminals used to deliver and control the malware, in a court-authorized operation carried out with the FBI and law-enforcement partners in eight other countries.

Source: U.S. Department of Justice via CRWE World

The department said Gootloader has infected at least 25,000 computers around the world since 2018, and that the malware was used in ransomware attacks against at least 44 U.S.-based victims, causing approximately $28.8 million in losses. Victims worldwide were being notified, the department said, and anyone who now visits one of the seized domains will see a law-enforcement seizure banner instead of the criminals' pages.

What the officials said

“With court authorization, the Department of Justice and FBI, along with our international partners, conducted an online operation that liberated over 100 servers from malicious software, denying ransomware criminals a platform,” said Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division, who linked the action to the administration's cyber strategy. U.S. Attorney Peter McNeilly for the District of Colorado, where the case is being prosecuted, also praised the international partnership behind the disruption.

Kenneth DeChellis, Special Agent in Charge of the Defense Criminal Investigative Service (DCIS) Cyber Field Office, said the malware “targeted victims on a global scale, including attacks on the U.S. Department of War and the Defense Industrial Base” — the network of companies that supply the U.S. military. That reach into defence-linked systems is a central reason federal investigators treated a malware “loader” — software whose job is to sneak a first foothold onto a computer so heavier ransomware can follow — as a national-security problem, not only a fraud problem.

How Gootloader got in: fake legal documents on real websites

According to warrants unsealed this week, Gootloader infects computers through a variety of means, often by tricking people into downloading it. Europol's account of the wider Operation Endgame action describes the method in more detail: the operators planted fake legal documents and contract templates on hacked, legitimate WordPress websites, so people searching for contracts and templates downloaded the malware instead of a document. Security Affairs, an independent cybersecurity outlet, notes that Gootloader belongs to the GootKit malware family, active since 2014, and that the security firm Mandiant has tracked the actors behind GootKit under the name UNC2565.

Source: Security Affairs

That method matters for ordinary readers, including small businesses and trucking operators who routinely download load paperwork, contracts and templates from the open web: the danger was not only suspicious email attachments, but documents that looked routine, sitting on websites that were themselves real businesses whose WordPress sites had been compromised. The Justice Department said many of the more than 100 servers it cleaned were exactly that — compromised WordPress sites being used without their owners' knowledge to spread the malware.

One operation, two sets of numbers

The U.S. action ran in coordination with Operation Endgame, a multinational initiative against malware services. Europol's totals for the full Endgame round are larger and counted differently: it reported 257 domains removed and 235 servers taken down across three malware operations — Gootloader, CastleRAT and StealC — and said investigators identified about 6.4 million sets of stolen victim data in the seized criminal infrastructure. For Gootloader alone, Europol counted 14 servers taken down and 681 infected websites cleaned up, while the Justice Department counted more than 100 servers from which the malware was scrubbed. The two agencies have not reconciled the different counts, which appear to measure different things — servers seized outright versus servers cleaned, across different parts of the same operation.

Source: Europol via Security Point Break

Who ran the investigation, and what happens next

The Gootloader investigation was led by the DCIS, the FBI's Denver Field Office and the U.S. Army Criminal Investigative Division, working with Germany's Bundeskriminalamt (BKA), the Netherlands National Police's National High Tech Crime Unit, Canada's Royal Canadian Mounted Police and Ottawa Police Service, Danish Police, France's Paris Cybercrime Unit, the United Kingdom's National Crime Agency, the Australian Federal Police and Europol. Senior Counsel Thomas Dougherty of the Criminal Division's Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Jasand Mock for the District of Colorado are prosecuting the case.

The department's announcement did not name any arrested suspects, identify the malware's operators, or say exactly how many U.S. domains were seized, and no court date was announced — so the disruption, while large, is not presented by investigators themselves as the end of the group behind Gootloader. What happens next is victim notification around the world, continued prosecution in Colorado, and further Operation Endgame rounds against the services ransomware gangs rent to break into computers. For website owners, the practical lesson from the warrants is direct: a compromised WordPress site can be turned into a delivery vehicle for ransomware without the owner ever knowing, which is why investigators cleaned more than 100 of them in a single action.