The United States Department of Justice has announced the disruption of Gootloader, a malware loader that has infected at least 25,000 computers around the world since 2018 and helped pave the way for ransomware attacks. The operation, announced on Thursday 12 November, removed the malware from more than 100 computer servers and seized US domain names used to deliver and control it.

According to the US Department of Justice, the servers cleaned in the court-authorised operation included compromised WordPress websites. Gootloader has been used in ransomware attacks against at least 44 victims in the United States, causing approximately $28.8 million in losses. The department said people visiting the seized domains would now see a law enforcement notice.

Assistant Attorney General A. Tysen Duva said the operation had “liberated over 100 servers from malicious software, denying ransomware criminals a platform”. The investigation was led by the Defense Criminal Investigative Service, the FBI’s Denver Field Office and the Army Criminal Investigation Division, working with police and agencies in Germany, the Netherlands, Canada, Denmark, France, the United Kingdom and Australia, as well as Europol.

Gootloader works by tricking people into downloading it, often after they click on poisoned search results that lead to compromised websites. Once a computer is infected, the loader can pull down further malicious software, including ransomware that locks files and demands payment. That is why investigators targeted the delivery infrastructure rather than individual infections: removing the servers and domains cuts off the route the criminals used to reach new victims.

Part of a wider Operation Endgame phase

The action was coordinated with Operation Endgame, the multinational law enforcement initiative aimed at dismantling the malware services that supply cybercriminals. BleepingComputer reports that the wider phase of the operation also targeted two other malware operations, the CastleRAT remote access trojan and the StealC information stealer. Across the three operations, authorities seized 235 servers and 257 domains and identified 6.4 million victim datasets on the criminal infrastructure.

Within that wider action, the Gootloader element accounted for 14 servers and 218 domains, and responders cleaned 681 compromised websites. The figures describe different parts of the same coordinated effort: the Justice Department’s announcement covers its own Gootloader action, while the Europol-coordinated totals cover all three malware families together.

An international effort

The Shadowserver Foundation, a non-profit security organisation, helped internet providers and computer security response teams identify infected systems, notify victims and support clean-up work. That victim-notification work matters because taking down servers does not by itself clean computers that are already infected.

The operation is the latest in a series of actions under Operation Endgame. In June 2026, an earlier phase cleaned nearly 15,000 malware-infected WordPress websites and seized 106 servers used by the SocGholish botnet and the Evil Corp cybercrime group. Later that month, action against the Amadey and StealC operations took down 326 servers and 142 domains and recovered around 27 million credentials stolen from more than 385,000 compromised systems.

Disruption, not an ending

The announcement did not name any arrests, identify Gootloader’s operators, or say how many US domain names were seized. Nor does it mean every infected computer has been cleaned: the 25,000 figure describes infections since 2018, not machines fixed this week. Security researchers have repeatedly warned that criminal groups rebuild infrastructure after takedowns unless arrests follow.

Even so, the operation removes a long-running route into victims’ computers. Website owners should keep WordPress and plugins updated, and computer users should be wary of downloads offered through search results. Anyone who suspects their machine may have been infected should seek help from their IT team or a trusted security professional rather than trying to remove the malware alone.