DOJ says Gootloader seeded 44 ransomware cases costing $28.8 million
Original title: DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018
Prosecutors say the loader infected 25,000 devices since 2018; authorities removed it from more than 100 servers.
The Justice Department detailed an international takedown of infrastructure used by Gootloader, alongside StealC and CastleRAT. Officials said Gootloader, active since 2018, infected 25,000 devices and was used in more than 44 US ransomware cases totaling $28.8 million in losses. Victims typically downloaded it by accident, after which operators sold access to ransomware gangs. Seized domains now show a seizure banner. The action is part of Operation Endgame.
Unconfirmed: Loss, infection, and victim figures come from Justice Department statements and unsealed court documents.
- A wider takedown disrupted 235 servers and 257 domains.
- The DOJ said it removed Gootloader from more than 100 servers, including compromised websites.
- A Defense official said targets included the Department of War and the defense industrial base.
- Shadowserver worked with ISPs and CSIRTs to identify infected systems and notify victims.
Impact: Botnet access sold for ransomware; $28.8 million in stated losses
- Malware
- GootloaderStealCCastleRAT
- Victims
- U.S. Department of War
- Organizations
- Justice DepartmentFBIShadowserver Foundation
- Countries
- United States
From the original article
2 min read at therecord.mediaIn a briefing adjacent to European announcements about an international anti-malware operation, U. S. officials detailed the history and impact of the Gootloader ransomware.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.