United States authorities have removed the Gootloader malware from more than 100 computer servers and seized the web domains criminals used to spread it, in an international operation announced on Thursday 12 November 2026.

The US Department of Justice said the court-authorised operation was carried out with the FBI and law enforcement partners in several countries. The servers cleaned in the operation included compromised WordPress sites that had been turned into delivery points for the malware.

Gootloader has infected at least 25,000 computers around the world since 2018, according to the department. It has been used in ransomware attacks against at least 44 victims in the United States, causing approximately $28.8 million in losses.

How Gootloader reached victims

According to warrants unsealed this week, Gootloader infects computers in a variety of ways, often by tricking people into downloading it. Once on a machine, it can open the way for further attacks, including ransomware, which locks victims out of their files until a payment is made.

The Justice Department said the operation targeted the infrastructure that delivered and controlled the malware, rather than individual infected computers. Visitors to the seized domains will now see a law enforcement seizure notice instead of the criminal operation's content.

Assistant Attorney General A. Tysen Duva of the department's Criminal Division said: "With court authorization, the Department of Justice and FBI, along with our international partners, conducted an online operation that liberated over 100 servers from malicious software, denying ransomware criminals a platform."

An international investigation

The investigation was led by the Defense Criminal Investigative Service, the FBI's Denver Field Office and the Army Criminal Investigative Division. They worked with Germany's Federal Criminal Police Office, the Netherlands National Police, the Royal Canadian Mounted Police and the Ottawa Police Service, Danish Police, the Paris cybercrime unit, the United Kingdom's National Crime Agency, the Australian Federal Police and Europol.

The action was coordinated with Operation Endgame, a multinational law enforcement initiative that targets the malware services criminals rely on to run ransomware and other cybercrime.

The announcement is a disruption of delivery infrastructure, not a guarantee that every infected device has been cleaned. The department's figures describe the historical impact of Gootloader since 2018, not the number of infections found in this week's operation, and the release did not give a figure for how many domain names were seized.

Organisations that run WordPress sites should keep their software and plug-ins updated and check for unfamiliar administrator accounts or files, since compromised websites were a central part of how this malware reached victims.