Police have cut into Gootloader’s malware delivery network by cleaning compromised websites and taking over criminal domains. The November 12 announcements describe an attack on the route from an apparently useful search result to a ransomware foothold—not a remote cleanup of every computer previously infected.
The US Justice Department reports malware removed from more than 100 servers. Dutch police separately report 681 websites disinfected, 218 domains confiscated and 14 servers taken down in the Gootloader action. These are different measures of infrastructure affected; they should not be added together as a count of victims.
A real website could become the delivery point
Dutch investigators describe attackers compromising WordPress websites and manipulating search visibility to bring visitors to malicious pages. That is the deceptive part of this route: a familiar search engine can lead to a website whose owner is also a victim. A high result position does not establish that the file offered there is safe.
The Justice Department’s account of the unsealed warrants follows what came after the download. Infected computers joined a botnet, and the operators used that access to infect further machines and sell access to ransomware criminals. The initial delivery and the eventual extortion could therefore be separate stages, involving different operators.
Cleaning a compromised site removes a delivery point; taking over a domain can interrupt a route used to deliver or control the malware. Neither action, on its own, establishes what already ran on a visitor’s computer or what a subsequent buyer did with access.
Why the numbers need their dates and scope
The Justice Department links Gootloader to at least 25,000 infected computers worldwide since 2018, and to ransomware attacks against at least 44 US victims with about $28.8 million in losses. Those are historical impact figures, not a count of computers cleaned in this week’s operation.
The broader Operation Endgame also targeted CastleRAT and StealC. Their infrastructure figures describe other malware networks. The existing StealC guide explains the separate problem of stolen passwords and sessions; this Gootloader action concerns the delivery chain that can precede a later intrusion.
A seized domain is a disruption signal, not a clean bill of health
The official seizure notice is useful evidence that authorities took control of a particular domain. It is not a diagnostic result for the device viewing it. Likewise, an ordinary website owner should verify a remediation notice through an independently located police, hosting-provider or incident-response contact before following instructions in an unexpected message.
If you only encountered a search result, this announcement does not establish an infection. If you downloaded and ran an unexpected file, stop using that device for sensitive logins and investigate the execution. A security tool may remove the visible payload while a loader or scheduled task remains. On Windows, download Gridinsoft Anti-Malware, update its database, run a Full Scan, review and remove detections, then restart. If alerts return, investigate persistence; a scan does not recover stolen information or prove that no access occurred.
The operation removes parts of a criminal delivery business. For an affected person or organization, the remaining question is what happened before that route was cut.
References
- US Department of Justice. “Gootloader Malware Disrupted in International Cyber Operation.” November 12, 2026. Official announcement.
- Netherlands Police. “International action disables cybercriminal network.” November 12, 2026; accessed November 13, 2026. Operation and delivery mechanism.
