The U.S. Department of Justice on Thursday announced the removal of “Gootloader” malicious software from more than 100 computer servers and the seizure of associated U.S. domain names.
The operation disrupts a network that has infected at least 25,000 computers worldwide since 2018, according to the Justice Department. The agency said criminals used the malware to enable ransomware attacks against at least 44 victims in the United States, causing approximately $28.8 million in financial losses.
Gootloader infects computers by tricking individuals into downloading it, the department said. These infected machines are then linked together into a network called a botnet. The operators of Gootloader sold access to these compromised computers to other groups who deployed ransomware.
According to the Department of War, the malware targeted organizations globally, including the agency itself and the defense industrial base. Assistant Attorney General A. Tysen Duva said the joint action “liberated over 100 servers from malicious software, denying ransomware criminals a platform.” The effort was part of Operation Endgame, an international initiative focused on dismantling malware services.
Law enforcement agencies worked with the Shadowserver Foundation, internet service providers, and security teams to find infected systems and help victims. The Justice Department said people who visit the seized website domains will now see a law enforcement notice. The investigation was led by DCIS, the FBI’s Denver office, and the Army Criminal Investigation Division, alongside police from several countries.