NEWS

DOJ Tallies Gootloader's Damage: 44 US Ransomware Victims and $28.8 Million

New: DOJ says Gootloader infected about 25,000 devices and seeded 44 US ransomware attacks costing $28.8M, following the Operation Endgame takedown.

Dylan H.

News Desk

November 13, 2026
2 min read
DOJ Tallies Gootloader's Damage: 44 US Ransomware Victims and $28.8 Million

Follow-Up

This updates our earlier coverage of the takedown: Operation Endgame Dismantles Gootloader, CastleRAT and StealC. What is new is the U.S. Justice Department's accounting of Gootloader's history and cost.

DOJ Figures

  • Gootloader has operated since 2018 and infected about 25,000 devices worldwide.
  • At least 44 U.S.-based ransomware victims were first infected through Gootloader, with total losses of $28.8 million.
  • Victims typically downloaded the malware by accident, which added their device to a botnet. Operators then sold access to that botnet to ransomware gangs.
  • The network spread through compromised websites.

The sources reviewed do not name the ransomware groups that bought access, and no defendants or specific charges were described.

The Operation

Law enforcement and security companies acted on Thursday. Gootloader was removed from more than 100 servers, including compromised websites, and several delivery and command domains were seized. The wider action disrupted 235 servers and 257 domains also supporting StealC and CastleRAT; StealC alone accounted for more than 100 servers.

The Shadowserver Foundation worked with ISPs and national CSIRTs to identify infected systems and notify victims. Seized domains now show a seizure banner. Officials said Gootloader targeted victims globally, including the defense industrial base. The action is part of Operation Endgame, which has previously hit DanaBot, IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee, Trickbot, Rhadamanthys, VenomRAT and the Elysium botnet.

Why It Matters

Gootloader is an access broker. A single loader infection can lead to ransomware weeks later, so removing it from servers does not clean up machines already infected. Defenders should treat any past Gootloader hit as a potential precursor to hands-on-keyboard intrusion.

Recommended Actions

  • Check for notifications from your ISP or national CERT about infected hosts.
  • Hunt for Gootloader indicators, including script-based downloads that originate from search results on compromised sites.
  • Restrict script hosts such as wscript.exe and cscript.exe from running files in user download paths.
  • Review EDR alerts for loader activity that was closed as low severity.

Sources