DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018
DOJ details Gootloader's role in 44 ransomware attacks causing $29M in losses.
The U.S. Justice Department has provided details on the international law enforcement operation that dismantled systems underpinning the Gootloader malware. This operation disrupted 235 servers and 257 domains used by Gootloader, StealC, and CastleRAT. Gootloader, active since 2018, infected 25,000 devices globally and was used to provide access for ransomware gangs, leading to at least 44 U.S. ransomware victims and $28.8 million in losses.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Shadowserver Foundation?
Get an email when a new story names Shadowserver Foundation, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGootloader operated for over six years by luring victims through SEO-poisoned search results, tricking users into downloading malicious files disguised as legitimate documents — a classic social engineering vector that exploited low security awareness. Once installed, it served as an initial access broker, handing off compromised systems to ransomware gangs, amplifying the damage far beyond the initial infection. The $28.8 million in losses across 44 ransomware victims demonstrates how a single malware family acting as an access broker can multiply risk across many organizations. The scale of the operation — 25,000 infected devices, 235 servers, and 257 domains — highlights how long-running malware infrastructures can persist when defenders lack adequate endpoint detection and threat hunting capabilities. Organizations must train users to scrutinize unexpected downloads and deploy layered endpoint controls to detect malware loaders before ransomware is deployed.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Gootloader
- malware — StealC
- malware — CastleRAT
- malware — DanaBot
- malware — IcedID
- malware — SystemBC
- malware — Pikabot
- malware — SmokeLoader
- malware — Bumblebee
- malware — Trickbot
- malware — Rhadamanthys
- malware — VenomRAT
- malware — Elysium