DOJ AND FBI DISRUPT GOOTLOADER MALWARE NETWORK EXPLOITING WORDPRESS SITES, LINKED TO 25,000 INFECTIONS AND $28.8 MILLION IN LOSSES

WASHINGTON, D.C. — The U.S. Department of Justice announced on November 12, 2026, that federal authorities and international law enforcement partners successfully disrupted the Gootloader malware operation, removing malicious software from more than 100 computer servers and seizing U.S. domain names used to distribute and control the malware. The coordinated operation targeted a cybercriminal infrastructure responsible for infecting at least 25,000 computers worldwide since 2018 and facilitating ransomware attacks against at least 44 victims in the United States, resulting in approximately $28.8 million in financial losses.

According to federal search warrants unsealed during the week of November 12, Gootloader operated as a malware distribution and initial-access platform, allowing cybercriminals to compromise computers and establish unauthorized access to affected systems. Attackers frequently relied on deceptive downloads and compromised websites to trick unsuspecting users into installing malicious software. Once infected, computers could become part of a larger network of compromised systems, commonly referred to as a botnet, providing the operators with infrastructure for additional attacks and unauthorized access.

The criminal operation extended beyond malware distribution. Federal authorities determined that the individuals operating Gootloader used their network to compromise additional computers before selling access to those infected systems to ransomware operators. This business arrangement allowed different cybercriminal groups to participate in separate stages of an attack, with Gootloader operators establishing initial access and other criminals exploiting that access to conduct ransomware intrusions. By separating the initial compromise from the eventual ransomware deployment, the operation supported a broader criminal marketplace built around the sale of unauthorized network access.

Compromised WordPress websites were among the servers used to support Gootloader’s distribution infrastructure. These legitimate websites had been exploited by cybercriminals and incorporated into the operation without authorization, enabling malicious content to reach visitors through otherwise established online platforms. The misuse of WordPress installations is particularly significant because the content management system supports a substantial number of business, publishing, and organizational websites worldwide. When attackers compromise legitimate sites, they can exploit existing traffic and established domain reputations to expose additional users to malicious downloads.

The Justice Department confirmed that the disruption was carried out under federal court authorization, allowing investigators to remove Gootloader malware from more than 100 affected servers while seizing domain names connected to the operation. The actions were intended to deprive cybercriminals of infrastructure used to distribute infections, coordinate compromised systems, and maintain access for additional criminal activity. The Justice Department stated that visitors accessing the seized domains would see law enforcement seizure notices identifying the federal action.

Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division described the operation as an effort to remove infrastructure supporting ransomware activity through coordinated legal and technical measures. U.S. Attorney Peter McNeilly for the District of Colorado emphasized the international cooperation required to identify and disrupt a criminal network operating across national borders. The investigation brought together federal agencies, foreign police organizations, cybersecurity specialists, and private-sector technical partners to identify compromised infrastructure and execute the court-authorized actions.

The investigation also identified national security implications associated with Gootloader’s criminal activity. Kenneth DeChellis, Special Agent in Charge of the Defense Criminal Investigative Service (DCIS) Cyber Field Office, confirmed that the malware had targeted victims globally, including attacks involving the U.S. Department of War and the Defense Industrial Base. The involvement of defense-related organizations demonstrates the potential consequences of malware distribution networks that provide unauthorized access to systems supporting government operations, defense contractors, and other sensitive industries.

FBI Cyber Branch Operations Director Brett Leatherman identified the network’s role in facilitating ransomware attacks and emphasized the importance of coordinated technical operations, victim notification, and remediation. The FBI worked with investigative partners to disrupt Gootloader’s ability to provide ransomware operators with access to compromised machines. Department of the Army Criminal Investigation Division Director L. Scott Moreland also addressed the operation, identifying international cooperation and continued cybersecurity vigilance as essential components of defending against organized cybercrime.

The Shadowserver Foundation provided additional technical assistance by coordinating with internet service providers and Computer Security Incident Response Teams (CSIRTs) to identify infected systems, assist in notifying victims, and support remediation efforts. These activities complemented the federal seizures by helping affected organizations and system operators identify remaining exposure and address infections associated with the disrupted infrastructure. Victim notification and remediation are important elements of botnet disruption because removing criminal infrastructure does not automatically repair every device or eliminate every form of unauthorized access previously established by attackers.

The operation was conducted in coordination with Operation Endgame, an international law enforcement initiative focused on dismantling the infrastructure and services that enable malware distribution, ransomware attacks, and other financially motivated cybercrime. Rather than concentrating exclusively on individual ransomware groups, the initiative targets the technical networks and criminal services used to support multiple operations. The Gootloader disruption formed part of a wider November 2026 enforcement effort that also targeted the CastleRAT and StealC malware ecosystems. Europol reported that the broader coordinated actions involved 235 servers and 257 domains, figures covering the multinational operation rather than Gootloader alone.

The Gootloader investigation was led by the Defense Criminal Investigative Service, the FBI’s Denver Field Office, and the Department of the Army Criminal Investigation Division. International participants included Germany’s Federal Criminal Police Office (Bundeskriminalamt), the Netherlands National Police’s National High Tech Crime Unit, the Royal Canadian Mounted Police, Ottawa Police Service, Danish Police, France’s Paris Cybercrime Unit, the United Kingdom’s National Crime Agency, the Australian Federal Police, and Europol. Their participation enabled investigative and technical measures across multiple jurisdictions associated with the criminal infrastructure.

Additional technical assistance was provided by the Justice Department’s International Computer Hacking and Intellectual Property (ICHIP) program in The Hague, the Fraunhofer Institute for Communication, Information Processing and Ergonomics (FKIE), Registrar of Last Resort (RoLR), OpenAI, and Sharktech, Inc. These organizations contributed technical capabilities to support the investigation and coordinated disruption. The Justice Department’s Office of International Affairs also assisted in facilitating the international enforcement effort.

Senior Counsel Thomas Dougherty of the Justice Department’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Jasand Mock for the District of Colorado are prosecuting the case. CCIPS handles federal investigations and prosecutions involving cybercrime and intellectual property offenses, working alongside domestic and international law enforcement agencies and private-sector partners. According to the Department, the section has secured convictions against more than 220 cybercrime and intellectual property offenders since 2020, along with court orders directing the return of more than $500 million in victim funds.

The Department’s ICHIP program also supports international efforts to strengthen cybercrime investigations, prosecutions, and judicial cooperation. Jointly administered through the Criminal Division’s Office of Overseas Prosecutorial Development, Assistance and Training (OPDAT) and CCIPS, the program operates in partnership with the U.S. Department of State’s Bureau of International Narcotics and Law Enforcement Affairs. Its responsibilities include providing technical and legal assistance to foreign authorities confronting cybercrime operations that extend beyond individual national jurisdictions.

The November 12 enforcement action represents a direct intervention against the infrastructure supporting a longstanding malware distribution operation. By removing malicious software from compromised servers, seizing criminally controlled domains, coordinating victim remediation, and disrupting access sold to ransomware operators, federal and international authorities targeted multiple components of the Gootloader network. The investigation also demonstrates the continuing vulnerability of legitimate websites and connected computer systems to exploitation by criminal organizations that specialize in obtaining and selling unauthorized access.

The coordinated disruption of Gootloader’s infrastructure reinforces the importance of continued protection against compromised websites, suspicious downloads, unauthorized account activity, and infected endpoints. The Justice Department’s action also demonstrates the effectiveness of international law enforcement cooperation in confronting cybercriminal services that operate across borders and contribute to financial losses, data theft, and attacks against government and private-sector networks.

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE