IC Technology & Cyber — 2026-11-15

DOJ Announces Coordinated Takedown of Gootloader Malware Network Targeting Pentagon

BLUFDismantling Gootloader's infrastructure degrades a key access-broker layer feeding ransomware affiliates, but defense contractors should treat the DCIS disclosure as a trigger to audit networks for intrusions stretching back years.

The Justice Department announced on November 12 that it removed Gootloader malware from more than 100 servers, including compromised WordPress sites, and seized U.S. domain names used to deliver and control it 12. DOJ said Gootloader has infected at least 25,000 computers since 2018 and was used in ransomware attacks on at least 44 U.S. victims, causing about $28.8 million in losses 1. Defense Criminal Investigative Service official Kenneth DeChellis said the malware targeted the Department of War and the Defense Industrial Base 1. The Record reported the action was part of a wider Thursday takedown of 235 servers and 257 domains also tied to StealC and CastleRAT 3, and SecurityWeek reported disruption of all three strains' infrastructure 4. DOJ said the operation ran under Operation Endgame, with the FBI Denver office, DCIS and Army CID leading and Shadowserver assisting with victim notification 1.

Analysis
Removing Gootloader from more than 100 servers cuts a loader that sold access to ransomware crews, but the crews themselves remain. Defense contractors should review logs for Gootloader-linked intrusions dating to 2018, since investigators say the Department of War and Defense Industrial Base were targeted. Shadowserver's notifications through internet service providers and CSIRTs will reach infected hosts, so notified organizations should expect remediation requests. Striking Gootloader, StealC and CastleRAT together shows DOJ concentrating on the loader and access-broker layer that feeds ransomware affiliates. Confidence is high because a primary DOJ release is confirmed in detail by three independent outlets, though the infection count and loss figures trace to DOJ alone. The seizure may prove a brief setback, since operators who keep their code and affiliate relationships can rebuild delivery on fresh compromised sites, and the Pentagon framing may reflect DOJ messaging more than a distinct military targeting campaign.

4 sources

Gootloader Malware Disrupted In International Cyber Operation - U.S. Department of Justice, Office of Public Affairs
Justice Dept. announces coordinated takedown of malware network used to target the Pentagon - Inside Cybersecurity
DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018 - The Record (Recorded Future News)
Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure - SecurityWeek