Police remove Gootloader from 100-plus servers after 25,000 infections
Original title: Gootloader Malware Disrupted After Infecting 25,000 Computers
The Justice Department says ransomware use against at least 44 US victims caused about $28.8 million in losses.
The US Department of Justice said law enforcement removed Gootloader from more than 100 servers, including compromised WordPress sites, seized US domains used to deliver and control it, and notified victims. Since 2018 the malware has infected at least 25,000 computers; operators sold botnet access to ransomware groups. The Justice Department said at least 44 US victims, including the Department of War and the Defense Industrial Base, lost about $28.8 million. The court-authorized action was coordinated with Operation Endgame and partners in Europe, Canada, the UK, and Australia, with technical help from OpenAI, Fraunhofer FKIE, Shadowserver, and Sharktech.
- Seized domains now show a law enforcement seizure banner.
- Gootloader has been used to deliver SunCrypt, REvil, Kronos, and Cobalt Strike.
- Mandiant tracked GootKit operators as UNC2565; the family has been active since 2014.
- Shadowserver worked with ISPs and CERTs to find infected machines and help cleanup.
Impact: Botnet access sold onward for ransomware and other payloads
- 1.If contacted by Shadowserver or a national CERT, follow their Gootloader cleanup guidance.
- Threat actors
- UNC2565
- Victims
- Department of War
- Countries
- United States
From the original article
3 min read at securityaffairs.comInternational law enforcement disrupts Gootloader, seizing domains and taking down over 100 servers linked to 25,000 infected computers. The U. S.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.