Justice Department seizes Gootloader domains after 44 attacks and $28.8 million in losses

Justice Department officials said that on Thursday an international coalition dismantled more than 100 servers used by StealC and disrupted 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC. The officials linked Gootloader to at least 44 U.S.-based ransomware victims and $28.8 million in losses since 2018. Court documents unsealed this week show that victims typically downloaded Gootloader by mistake and joined a botnet.

Justice Department officials said Gootloader has existed since 2018 and infected at least 25,000 computers worldwide. FBI Cyber Branch Operations Director Brett Leatherman said hackers used compromised websites to infect thousands of computers with the malware. He said that access let cybercriminals deploy ransomware.

Working alongside our partners, we disrupted the Gootloader botnet through coordinated technical operations, victim notifications, and remediation.

Brett Leatherman, FOX 35 Orlando

Kenneth DeChellis said Gootloader targeted victims globally, including the U.S. Department of War and the Defense Industrial Base. One source identifies him as a Defense Department official; another associates him with the Department of War, formerly known as the Department of Defense.

Gootloader is a loader, malware that downloads other programs once installed on a computer, and is often used to deliver ransomware. Operators posted fake legal documents on compromised websites, frequently WordPress sites, and used search-engine poisoning—manipulating search results to place malicious links at the top—to rank those sites highly in search results.

The Justice Department removed Gootloader from more than 100 servers, including compromised WordPress sites, Assistant Attorney General A. Tysen Duva said. Prosecutors seized domain names criminals used to deliver and control the malware, Duva added. Visitors to seized domains now see a seizure banner.

The action was part of Operation Endgame, a long-running international effort to disrupt major malware strains and botnets. Europol‘s operation summary says police seized 235 servers and 257 domains across the three malware tools. Earlier parts of the operation disrupted DanaBot, IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee and Trickbot, and also took down the Elysium botnet, VenomRAT and Rhadamanthys. Last year the Justice Department took down AVCheck.net, Crypt.guru, Cryptor.live and Cryptor.biz, which officials described as sites for testing malware against antivirus products.

Police removed Gootloader from 681 hacked websites and took down 14 servers and 218 domains for that loader. German police said investigators believe Gootloader has infected millions of computers around the world since it emerged in 2020.

CastleRAT is a remote access trojan known since 2025 that lets attackers control an infected computer remotely, and police took 120 CastleRAT servers and 39 domains. The StealC infostealer grabs passwords and login credentials from infected computers to sell or misuse them. Police took down StealC servers again this week after a June operation, and Dutch police said operators changed infrastructure and brought the service back online after that earlier action.

Police shut down Virtualine/Omegatech, a bulletproof hosting service used by StealC, in a late-October takedown. Authorities announced no arrests for this week’s operation, though Dutch police also investigated Gootloader’s main suspect.

DCIS, the FBI’s Denver Field Office and the Army Criminal Investigative Division led the investigation. International partners included Germany’s Bundeskriminalamt and the Netherlands National Police’s National High Tech Crime Unit, Canada’s Royal Canadian Mounted Police and Ottawa Police Service, Danish Police and the Paris Cybercrime Unit, and the United Kingdom’s National Crime Agency, the Australian Federal Police and Europol.

ICHIP the Hague, Fraunhofer FKIE, Registrar of Last Resort (RoLR), OpenAI and Sharktech, Inc. provided technical assistance. Thomas Dougherty, senior counsel in the Computer Crime and Intellectual Property Section, and Assistant U.S. Attorney Jasand Mock for the District of Colorado are prosecuting the case.

U.S. Attorney Peter McNeilly for the District of Colorado said cybercrime knows no borders and praised international partnerships. L. Scott Moreland of the Army Criminal Investigation Division said the takedown underlines the strength of unified international law enforcement operations.

The Computer Crime and Intellectual Property Section handles cybercrime and intellectual property cases. Since 2020, CCIPS has won convictions of over 220 cyber and IP criminals and court orders returning over $500 million to victims.

WPZoom estimates that WordPress powers about 39.5% of all websites. Danish police said attackers entered compromised sites using stolen passwords from criminal channels and installed a backdoor. Police in Denmark and the Netherlands advise WordPress owners to use unique administrator passwords of at least 12 characters and turn on multifactor authentication. Owners should also remove unrecognized accounts and backdoor code, update WordPress themes and plugins, and limit /wp-admin access to their own devices’ IP addresses.

Denmark’s National Special Crime Unit helped clean 681 websites during the operation. Dutch police put CastleRAT-stolen data into Check your hack so people can check whether an email address is affected, and police say more stolen data will be added soon. Organizations can join No More Leaks, and stolen data is shared with Have I Been Pwned and the Shadowserver Foundation.

Police say e-mails claiming to come from the police and asking people to check data are fake, and police never send e-mails with links. Criminals may still hold stolen logins after police seize the data, and as long as malware remains on a computer, criminals may keep obtaining its passwords. In Germany, the Federal Office for Information Security is assisting with victim notifications, the Bundeskriminalamt said. Brett Leatherman said the operation lets authorities protect victims from more harm and stop future exploitation.