DOJ says Gootloader seeded at least 44 US ransomware attacks and $28.8 million in losses

The Justice Department has put numbers on Gootloader. In court documents unsealed this week and a follow-up notice on Thursday, officials said the malware has existed since 2018, was used to infect 25,000 devices globally, and seeded more than 44 ransomware attacks against U.S.-based victims, with total losses of $28.8 million.

The takedown itself was announced alongside a wider international operation. A coalition of law enforcement agencies and security companies dismantled more than 100 servers used by the StealC password stealer, as part of a broader action that disrupted 235 servers and 257 domains also tied to Gootloader and CastleRAT. Assistant Attorney General A. Tysen Duva said the department removed Gootloader from more than 100 servers, including compromised websites, and seized several domain names used to deliver and control it. Compromised domains now show a seizure banner.

What happened

FBI Cyber Branch Operations Director Brett Leatherman said the network of hijacked websites was used to infect thousands of computers, giving the operators the access needed to deploy ransomware. Prosecutors said victims usually downloaded Gootloader by accident, which added their machine to a botnet. Access to that botnet was then sold to ransomware gangs.

The Defense Department's Kenneth DeChellis said in a statement that Gootloader "targeted victims on a global scale, including attacks on the U.S. Department of War and the Defense Industrial Base." The article doesn't say what those attacks involved, when they happened, or whether they succeeded.

The Shadowserver Foundation worked with internet service providers and national CERTs to find infected systems and notify victims. The takedowns fall under Operation Endgame, the long-running effort that previously went after DanaBot, IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee, Trickbot, Rhadamanthys, VenomRAT and the Elysium botnet.

The mechanism, and why the numbers matter

Gootloader's trick is search. Its operators seeded pages that looked like ordinary results for people hunting business documents, contracts and legal templates, and the payload arrived when someone opened what they thought was a file. That's why the DOJ describes victims as downloading it accidentally. There's no exploit chain to speak of at the front door; the delivery depends on a person trusting a search result.

The rest is a supply chain. Gootloader's operators weren't the ones encrypting files. They held the initial foothold and sold it. That split is what makes the 44 figure worth reading carefully: it counts ransomware victims whose first infection was Gootloader, not every machine the malware touched. The gap between 25,000 infected devices and 44 ransomware cases is the part of the botnet that was used for something else, or nothing yet.

HackZoneLabs assessment

The headline number here is the loss figure, and it's the least interesting part. $28.8 million across 44 victims is a median in the low hundreds of thousands, which is ordinary for mid-sized ransomware cases and says more about the victims' size than about Gootloader's sophistication. In our view the 25,000-device figure is the one that matters, because it describes a long-lived delivery channel that fed multiple ransomware crews for years without needing a new vulnerability. Disrupting the servers removes the delivery path, not the operators' playbook, and the same search-poisoning approach has been copied by others.

We'd also treat the "thousands of computers" phrasing from the FBI as deliberately vague. It doesn't reconcile with the 25,000 figure, and the article doesn't explain the difference. It may be a subset tied to a specific server set, or a different counting method. Nobody has said.

What remains unknown

The article doesn't say how many of the 25,000 devices were cleaned, how many victims were notified, or whether any of the seized infrastructure has been replaced. It doesn't name the ransomware families that bought access, and it doesn't say whether anyone has been charged. The Defense Department reference to the "U.S. Department of War" is quoted as given; the article offers no further detail on those intrusions.

For defenders, the practical question is whether any host in your estate ever fetched a Gootloader payload. The delivery pattern is a user opening a document from a search result, so endpoint logs and proxy records from the past few years are where to look, not vulnerability scans. If a machine was in that botnet, the infection predates whatever ransomware followed it, and the timeline matters for scoping. Shadowserver's notifications are the other thread: if your organisation received one, it's worth checking what was done about it.