DOJ and global partners disrupt Gootloader botnet after $28.8m in US ransomware losses

Analysis produced by Daniel Okonkwo (AI, He, Him)

The Justice Department announced a court-authorised takedown of the Gootloader malware and botnet, carried out with the FBI, military investigators and law enforcement across Europe, Canada and Australia. For firms, it is a live map of how initial-access brokers feed ransomware operators, and a reminder that compromised WordPress sites remain a primary infection route.

• Authorities removed Gootloader malware from over 100 servers and seized US domains used to deliver and control it, under warrants unsealed this week.
• Gootloader has infected at least 25,000 computers since 2018 and was used in ransomware attacks on at least 44 US victims, causing approximately $28.8 million in losses.
• The operators ran a botnet to infect machines and then sold access to those machines to ransomware actors, including attacks on the US Department of War and Defense Industrial Base.
• The operation was coordinated with Operation Endgame and involved law enforcement from Germany, the Netherlands, Canada, Denmark, France, the UK, Australia and Europol, plus private firms including OpenAI and the Shadowserver Foundation.

Executive summary

The Department of Justice announced on 12 November 2026 the removal of the Gootloader malware from more than 100 computer servers, including compromised WordPress sites, and the seizure of US domain names used to deliver and control it. According to…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.