Europol's statement leads with hardware: 235 servers and 257 domains seized in a strike on the Gootloader, CastleRAT and StealC malware networks. BleepingComputer opens the same way, hundreds of servers and domains seized by Europol and partners from nine countries. Neither opening mentions American victims or what they lost. The Justice Department's own release does.
The DOJ said Thursday it removed Gootloader from over 100 servers, including compromised WordPress sites, and seized U.S. domain names that criminals used to deliver and control the malware. Since 2018, the department said, the malware infected at least 25,000 computers and was used in ransomware attacks on at least 44 U.S. victims, with approximately $28.8 million in loss. "Using a network of compromised websites, Gootloader malware infected thousands of computers worldwide, providing cybercriminals with access to deploy ransomware and cause millions of dollars in losses," said Operations Director Brett Leatherman of the FBI Cyber Branch.
The department explains the business model. According to warrants unsealed this week, Gootloader infects computers by tricking people into downloading it, then adds each infected machine to a botnet. The people running it used that botnet to infect more computers and then sold access to those machines to ransomware actors, the DOJ said. Assistant Attorney General A. Tysen Duva of the Criminal Division said the court-authorized operation freed over 100 servers and denied ransomware criminals a platform. U.S. Attorney Peter McNeilly for the District of Colorado said the case shows international partnerships protecting people around the world.
Europol, in the statement BleepingComputer cites, said authorities found 6.4 million victim datasets on the seized infrastructure. Those were credentials stolen from infected systems, which Europol said the suspects sold for use in later attacks, including ransomware. BleepingComputer describes StealC as an infostealer that pulls passwords and cryptocurrency wallets from victims' devices and CastleRAT as a remote access trojan that surfaced last year. It reports the strike is part of Operation Endgame, which in June cleaned nearly 15,000 infected WordPress sites and took down 106 servers tied to the SocGholish botnet, and later disrupted Amadey and StealC infrastructure.
The DOJ said the Shadowserver Foundation worked with internet providers and incident response teams to find infected systems, notify victims and help them clean up. Senior Counsel Thomas Dougherty of the Criminal Division's Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Jasand Mock for the District of Colorado are prosecuting the case. The department said that section has won convictions of over 220 cyber and intellectual property criminals since 2020 and court orders returning over $500 million to victims. The servers are the method. The 44 victims are the story.
