Gootloader Malware Disrupted After Infecting 25,000 Computers
Gootloader malware operation disrupted, 100+ servers seized, 25,000 computers affected.
International law enforcement has disrupted the Gootloader malware operation, seizing over 100 servers and U.S. domain names used for control and delivery. Since 2018, Gootloader has infected approximately 25,000 computers globally, often spreading through compromised websites. The malware operates on an access-as-a-service model, selling access to ransomware groups, and has been linked to ransomware attacks causing an estimated $28.8 million in losses to at least 44 U.S. victims.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonGootloader spread primarily through compromised legitimate websites, tricking users into downloading malicious files—a technique that succeeds when users lack awareness of web-based malware delivery. Operating as an access-as-a-service broker, it lowered the barrier for ransomware groups to launch attacks, amplifying harm far beyond the initial infection. Over six years and 25,000 infections, the operation caused an estimated $28.8 million in losses before law enforcement intervened. This case underscores how malware ecosystems that commoditize initial access can persist and scale when defenders fail to detect infections early or block malicious download behavior. Timely endpoint detection, user education about suspicious downloads, and proactive vulnerability management of web-facing assets are critical defenses.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — REvil
- malware — Sodinokibi
- malware — Gootloader
- malware — GootKit
- malware — SunCrypt
- malware — Kronos
- malware — Cobalt Strike