Police Seize 257 Domains Behind Gootloader, the Fake-Contract Malware the DOJ Ties to 44 U.S. Ransomware Attacks and $28.8 Million in Losses

A coordinated international takedown this week knocked out the delivery network behind Gootloader, a long-running piece of malware that hid inside fake contracts and legal templates and quietly sold its victims to ransomware gangs. According to the U.S. Department of Justice, Gootloader has infected at least 25,000 computers worldwide since 2018 and was the first foothold in ransomware attacks against at least 44 U.S.-based victims, with roughly $28.8 million in losses.

The action was part of Operation Endgame, the multinational campaign against the tools ransomware crews rely on to break in. Europol said police and private partners in nine countries actioned 235 servers and 257 domains tied to three malware families, Gootloader, the CastleRAT remote access trojan and the StealC password stealer, and found more than 6.4 million stolen victim datasets sitting on the criminals’ infrastructure.

What Was Taken Down

Europol’s breakdown shows how much of the operation’s weight fell on Gootloader’s web footprint:

• Gootloader: 14 servers and 218 domains taken down, and 681 infected websites cleaned up, per Europol.
• CastleRAT: 120 servers and 39 domains seized. Europol said the trojan was linked to encrypted data, crippled IT systems and ransom payments at affected organizations.
• StealC: 102 servers dismantled, continuing a June 2026 action against the same stealer.
• Stolen credentials: more than 6 million victim credentials identified. Europol said the suspects were selling them for later attacks, including ransomware, and that the data will be shared with notification services such as HaveIBeenPwned and The Shadowserver Foundation.

In a follow-up notice, Assistant Attorney General A. Tysen Duva said the Justice Department removed Gootloader from more than 100 servers, including compromised WordPress sites, and seized U.S. domain names used to deliver and control the malware, The Record reported. Visitors to the seized domains now see a law enforcement seizure banner. Neither the DOJ nor Europol named any arrests in their announcements.

The U.S. side of the investigation was led by the Defense Criminal Investigative Service, the FBI’s Denver Field Office and Army CID, alongside agencies including Germany’s BKA, the Dutch National Police, the RCMP, the UK’s National Crime Agency, the Australian Federal Police and Europol. A Defense Department official, Kenneth DeChellis, said Gootloader had targeted victims globally, “including attacks on the U.S. Department of War and the Defense Industrial Base,” without giving further detail.

How Gootloader Turned Search Results Into Ransomware

Gootloader did not need a software vulnerability to get in. According to Europol, its operators planted fake legal documents on compromised websites, often hacked WordPress sites, and anyone who downloaded one became infected. Analysts at HackZoneLabs note that the pages were built to look like ordinary search results for people hunting for contracts, agreements and business templates, which is why prosecutors describe victims as downloading the malware by accident.

Once a machine was infected, it joined a botnet. Court documents unsealed this week say the Gootloader operators then sold access to those machines to ransomware actors. In other words, Gootloader functioned as an initial access broker: it did not encrypt files itself, it rented out the front door to the gangs that did.

Why It Matters for Business

The average hit was large. Dividing the DOJ’s $28.8 million figure across 44 victims works out to roughly $650,000 per incident. That is only the U.S. cases that prosecutors could trace back to Gootloader, so it is a floor, not a ceiling.

The lure targets the people who handle money and contracts. Legal, finance, HR and procurement staff search for templates every day. A malware campaign that waits for them at the top of a search result bypasses email filters entirely, which is why security training that focuses only on phishing emails leaves a gap.

Your website can become someone else’s weapon. Gootloader’s delivery depended on hijacked sites. Europol specifically urged WordPress users to update credentials, turn on multi-factor authentication and patch vulnerabilities. A compromised company site can expose visitors to malware and damage search rankings and brand trust long before anyone notices.

Stolen logins outlive the takedown. The 6.4 million victim datasets show how much credential theft feeds the ransomware economy. Seizing servers removes a marketplace, but passwords already sold are still in criminal hands, so companies should reset exposed credentials and check breach-notification services as the data is released.

Takedowns are disruptions, not endings. As BleepingComputer recounts, Operation Endgame has repeatedly hit loaders and botnets, including SocGholish, Amadey, StealC, DanaBot, IcedID, Pikabot, SmokeLoader, Bumblebee and Trickbot. StealC itself was already targeted in June, when police took down 326 servers and 142 domains and recovered about 27 million credentials. Malware families tend to regroup, and ransomware affiliates simply shop for access elsewhere.

What Security Teams Should Do Now

• Block or warn on script and archive downloads from search results, and treat “free contract template” downloads as a high-risk category.
• Audit company WordPress sites for unknown admin accounts, outdated plugins and injected pages, and enforce MFA for every administrator.
• Watch for victim notifications from Shadowserver, CERTs and HaveIBeenPwned, and force resets on any credentials that appear.
• Assume an infostealer infection means stolen session tokens as well as passwords, and revoke active sessions, not just passwords.

The Bottom Line

The Gootloader takedown puts hard numbers on a threat that has worked quietly for eight years: 25,000 infections, 44 traced U.S. ransomware cases and $28.8 million in losses, all starting with a document that looked like a routine business download. Operation Endgame has cut off this delivery route for now, but the lesson for businesses outlasts the seizure banners. The cheapest way into a company is often a person searching for something ordinary, and the cheapest launchpad is a poorly secured website.

Sources: U.S. Department of Justice, Europol, The Record from Recorded Future News, BleepingComputer, HackZoneLabs.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous