International operation removes Gootloader malware from more than 100 servers
US and European authorities say they seized domains, cleaned compromised servers and identified millions of stolen credentials in a coordinated malware disruption.
- Development
- 12 November 2026
- Coverage
- Breaking news
- Current status
- Developing case
- Source record
- 3 verified sources
Malware removed and domains seized
The Justice Department said an international operation removed Gootloader malware from more than 100 servers, including compromised WordPress sites, and seized U.S. domain names used to distribute and control the malicious software. Europol’s wider Operation Endgame action targeted Gootloader alongside CastleRAT and StealC, with authorities and private partners taking action against 235 servers and 257 domains. Officials described the work as a disruption rather than the end of every investigation, and said victim identification and remediation are continuing across several countries. [1] [2] [3]
Loader sold access used for ransomware
Investigators describe Gootloader as a loader that tricks users into downloading malicious files, sometimes through compromised websites offering fake legal documents. Once a device is infected, operators can place it inside a botnet and sell access to other criminals. The Justice Department said Gootloader has infected at least 25,000 computers since 2018 and was used in ransomware attacks involving at least 44 U.S. victims with about $28.8 million in losses. The figures reflect identified cases and may not represent every infection or downstream offense. [1] [2] [3]
Millions of credentials identified
Europol said the broader operation secured data connected to about 6.4 million victim credentials. The agency said stolen login information would be shared through services that notify affected users and organizations. Authorities advised WordPress administrators and other users to update passwords, enable multifactor authentication and patch known vulnerabilities. The Shadowserver Foundation and national computer-security response teams are assisting with notices and cleanup. No individual defendant was announced in the U.S. release, and the technical action does not by itself establish who operated each piece of the network. [1] [2] [3]
Nine-country investigation remains active
The Gootloader investigation involved the FBI, Defense Criminal Investigative Service, Army Criminal Investigation Division and law-enforcement partners in Germany, the Netherlands, Canada, Denmark, France, the United Kingdom and Australia. Europol and private-sector researchers provided coordination and technical help. Court-authorized warrants supporting the U.S. seizures were unsealed this week. Investigators will now analyze seized infrastructure, trace operators and notify victims. Officials warned that disrupted services can be rebuilt, making credential changes and software updates important even after servers have been cleaned. [1] [2] [3]
Disruption does not eliminate the wider threat
Taking servers and domains offline can interrupt infections and preserve evidence, but it does not automatically identify every operator or remove malware already present on victims’ computers. Organizations that downloaded compromised search results must still examine endpoints, credentials and network logs. Investigators can use seized infrastructure to map affiliates, hosting providers, payments and follow-on deployments. Europol’s reference to millions of victim datasets describes material secured during the operation, not a count of confirmed financial losses. Users should rely on their national cyber authority or trusted security provider for remediation guidance and avoid unsolicited “cleanup” messages, which criminals sometimes use to exploit publicity around a takedown. Companies should preserve forensic evidence before rebuilding affected systems because it can support both victim notification and later prosecutions. [1] [2] [3]
Sources & further reading
- Gootloader Malware Disrupted in International Cyber Operation ↗U.S. Department of Justice · 2026-11-12 · Primary source
- 6.4 million victim datasets secured in international operation against malware networks ↗Europol · 2026-11-12 · Primary source
- Police dismantle Gootloader, CastleRAT, StealC malware infrastructure ↗BleepingComputer · 2026-11-12
Reader comments.
Keep it respectful and relevant to the report. No personal information, harassment or unsupported accusations. Comments are readers’ views.
Loading your sign-in status…