THE CRUNCH
The Justice Department says it removed the Gootloader malware from more than 100 servers, including compromised websites, and seized several domains used to deliver and control the malware. The operation, announced on Thursday, was part of a wider international sweep that dismantled more than 100 servers running the StealC password-stealing malware and disrupted 235 servers and 257 domains also tied to the Gootloader and CastleRAT malware strains.
Gootloader has existed since 2018 and, according to the DOJ, infected 25,000 devices globally. The DOJ said more than 44 U.S.-based ransomware victims were initially infected through Gootloader, leading to $28.8 million in losses. In court documents unsealed this week, prosecutors said victims typically downloaded Gootloader accidentally, adding their machines to a botnet of infected computers. The hackers then sold access to that network to ransomware gangs.
FBI Cyber Branch Operations Director Brett Leatherman said the network was disrupted through coordinated technical operations, victim notifications and remediation. Defense Department official Kenneth DeChellis said in a statement that Gootloader targeted victims globally, including the U.S. Department of War and the Defense Industrial Base. The Shadowserver Foundation worked with internet service providers and Computer Security Incident Response Teams to identify infected systems and notify victims, and the seized domains now display a seizure banner.
The takedowns fall under Operation Endgame, a long-running international initiative against major malware strains and botnets. Previous phases targeted DanaBot, IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee and Trickbot, along with the Rhadamanthys infostealer, the VenomRAT remote access trojan and the Elysium botnet.