[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5-zaWK68FHnPCOjdug_8bSHwWz2TeNrEuSo5PehY7FI":3},{"article":4,"iocs":46,"watch_terms":80,"solutions":81,"lesson":170},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"a9e43bff-f7f4-4b7b-9001-968fb6f1642e","DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018","doj-gootloader-used-in-at-least-44-ransomware-attacks-costing-29-million-since-2-762fea","In a briefing adjacent to European announcements about an international anti-malware operation, U.S. officials detailed the history and impact of the Gootloader ransomware.","The U.S. Justice Department has provided details on the international law enforcement operation that dismantled systems underpinning the Gootloader malware. This operation disrupted 235 servers and 257 domains used by Gootloader, StealC, and CastleRAT. Gootloader, active since 2018, infected 25,000 devices globally and was used to provide access for ransomware gangs, leading to at least 44 U.S. ransomware victims and $28.8 million in losses.","DOJ details Gootloader's role in 44 ransomware attacks causing $29M in losses.","https:\u002F\u002Ftherecord.media\u002Fgootloader-ransomware-doj-details","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fgootloader_page_operation_endgame_d490d02942.png","2026-11-13T15:59:00+00:00","2026-11-13T17:00:14.391942+00:00",8,[17,20],{"name":18,"type":19},"Operation Endgame","campaign",{"name":21,"type":22},"Shadowserver Foundation","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50,53,56,59,61,63,65,67,69,71,74,77],{"type":27,"value":48,"context":49},"Gootloader","Malware strain used to deliver ransomware",{"type":27,"value":51,"context":52},"StealC","Password-stealing malware disrupted in the operation",{"type":27,"value":54,"context":55},"CastleRAT","Malware strain disrupted in the operation",{"type":27,"value":57,"context":58},"DanaBot","Malware strain previously disrupted by Operation Endgame",{"type":27,"value":60,"context":58},"IcedID",{"type":27,"value":62,"context":58},"SystemBC",{"type":27,"value":64,"context":58},"Pikabot",{"type":27,"value":66,"context":58},"SmokeLoader",{"type":27,"value":68,"context":58},"Bumblebee",{"type":27,"value":70,"context":58},"Trickbot",{"type":27,"value":72,"context":73},"Rhadamanthys","Infostealer disrupted by Operation Endgame",{"type":27,"value":75,"context":76},"VenomRAT","Remote access trojan disrupted by Operation Endgame",{"type":27,"value":78,"context":79},"Elysium","Botnet disrupted by Operation Endgame",[21],{"controls":82,"vendors":169},[83,111,140],{"slug":84,"name":85,"problem":86,"products":87},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":106,"url":109,"description":110},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":141,"name":142,"problem":143,"products":144},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[145,153,161],{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":162,"vendor_name":163,"vendor_logo":164,"product_slug":165,"product_name":166,"url":167,"description":168},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",[],{"slug":171,"title":172,"body":173,"framework_refs":174,"framework_notes":180},"gootloader-malware-enabled-44-ransomware-attacks-via-seo-poisoning-and-weak-endpoint-defenses","Gootloader Malware Enabled 44 Ransomware Attacks via SEO Poisoning and Weak Endpoint Defenses","Gootloader operated for over six years by luring victims through SEO-poisoned search results, tricking users into downloading malicious files disguised as legitimate documents — a classic social engineering vector that exploited low security awareness. Once installed, it served as an initial access broker, handing off compromised systems to ransomware gangs, amplifying the damage far beyond the initial infection. The $28.8 million in losses across 44 ransomware victims demonstrates how a single malware family acting as an access broker can multiply risk across many organizations. The scale of the operation — 25,000 infected devices, 235 servers, and 257 domains — highlights how long-running malware infrastructures can persist when defenders lack adequate endpoint detection and threat hunting capabilities. Organizations must train users to scrutinize unexpected downloads and deploy layered endpoint controls to detect malware loaders before ransomware is deployed.",[175,176,177,178,179],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1189: Drive-by Compromise","CIS Control 9: Email and Web Browser Protections (v8)","CIS Control 10: Malware Defenses (v8)","NIS2 Article 21(2)(g)",{"NIS2 Article 21(2)(g)":181,"MITRE ATT&CK T1566: Phishing":182,"CIS Control 10: Malware Defenses (v8)":183,"MITRE ATT&CK T1189: Drive-by Compromise":184,"CIS Control 9: Email and Web Browser Protections (v8)":185},"NIS2 requires basic cyber hygiene and training, which would address the user awareness gap exploited by Gootloader's social engineering through fake search results.","Gootloader used SEO poisoning to trick users into downloading malicious files, which is a form of user-targeted deception analogous to phishing for initial access.","CIS Control 10 mandates anti-malware and application control tools that detect and block malicious script execution, which is Gootloader's primary delivery mechanism.","Victims were directed via manipulated search results to malicious sites where Gootloader was downloaded, matching the drive-by compromise technique for gaining initial access.","CIS Control 9 requires filtering and protecting web browsing activity, which would have helped block access to SEO-poisoned pages delivering Gootloader payloads."]