International law enforcement disrupts Gootloader, seizing domains and taking down over 100 servers linked to 25,000 infected computers.The U.S. Department of Justice announced that law enforcement has removed Gootloader malware from more than 100 computer servers, seized U.S. domain names used to deliver and control it, and notified victims worldwide. “The Department of Justice today announced the successful removal of malware known as “Gootloader” from over 100 computer servers, including compromised WordPress sites, and the seizure of U.S. domain names used by criminals to deliver and control the Gootloader malware. Since 2018, Gootloader malware has infected at least 25,000 computers around the world.” states DoJ. “Gootloader malware has been used in ransomware attacks of at least 44 U.S. based victims which has resulted in approximately $28.8 million in loss.”Gootloader spreads mostly through compromised WordPress sites and other websites, where victims are tricked into downloading it thinking they’re getting something legitimate. Once a machine is infected it joins a botnet, and the people running Gootloader then sell access to those machines to ransomware groups. The ransomware groups do the rest, and the total losses to US-based victims alone reach roughly $28.8 million across at least 44 victims, including the Department of War and the Defense Industrial Base.GootLoader runs on an access-a-as-a-service model, it is used by different groups to drop additional malicious payloads on the compromised systems. GootLoader has been known to use fileless techniques to deliver threats such as the SunCrypt, and REvil (Sodinokibi) ransomware, Kronos trojans, and Cobalt Strike. In the past, GootLoader distributed malware masquerading as freeware installers and it used legal documents to trick users into downloading these files. GootLoader is a part of the GootKit malware family, which has been active since 2014. Mandiant tracked the threat actors behind GootKit as UNC2565.The law enforcement operation ran under court authorization and in coordination with Operation Endgame, the multinational law enforcement initiative targeting malware criminal services. Partners included Germany’s BKA, the Netherlands National Police, Canada’s RCMP and Ottawa Police Service, Danish Police, France’s Paris Cybercrime Brigade, the UK’s National Crime Agency, the Australian Federal Police and Europol. OpenAI, Fraunhofer FKIE, the Shadowserver Foundation and hosting company Sharktech also provided technical help.“According to warrants unsealed this week, Gootloader is malware that infects victim computers through a variety of means, often by tricking unsuspecting individuals into downloading it. Once infected, the compromised computers are added to a network of other compromised computers known as a botnet.” continues the report. “The actors behind Gootloader used the botnet to infect other computers, then sell access to those later-infected computers to ransomware actors.”The Shadowserver Foundation worked with internet service providers and national computer security response teams to find infected machines, tell victims what had happened and help them clean up. Visitors to any of the seized domains now see a law enforcement seizure banner instead of the malicious content. The investigation was led by the Defense Criminal Investigative Service, the FBI’s Denver Field Office and Army Criminal Investigative Division.“Dismantling the Gootloader malware and botnet, which infected over 25,000 systems worldwide, demonstrates the power of unified, international law enforcement operations,” said Director L. Scott Moreland, Department of the Army Criminal Investigation Division. “Alongside our global partners, Army CID is committed to taking the fight directly to cybercriminals. While disrupting these criminal networks stops ransomware attacks before they can take root, true cyber resilience relies on a combination of global law enforcement action and everyday personal vigilance.”Since 2020, CCIPS has secured convictions of more than 220 cyber and IP criminals and court orders returning over $500 million to victims. More details on Operation Endgame can be found at operation-endgame.com.Follow me on Twitter: @securityaffairs and Facebook and MastodonPierluigi Paganini(SecurityAffairs – hacking, Gootloader)