DOJ Removes Gootloader Malware From More Than 100 Servers
The DOJ says the operation disrupted a network linked to ransomware attacks against at least 44 US victims.
The US Department of Justice (DOJ) said on 12th November 2026 that an international operation had removed Gootloader malicious software from more than 100 computer servers, including those hosting compromised websites built with WordPress. A web server hosts websites, and WordPress is software for building them.
Authorities also seized US domain names, readable online addresses, used to distribute and control the malware, according to the department's press release.
The department said Gootloader had infected at least 25,000 computers worldwide since 2018. It linked the malware to ransomware attacks against at least 44 US victims, with approximately $28.8 million in losses. Ransomware attacks use malicious software to lock files, encrypt systems or steal data for extortion, as Danish police explain.
Citing warrants unsealed that week, DOJ said Gootloader often infected computers by tricking people into downloading it. Infected machines joined a botnet, a network of compromised computers. The operators used that network to infect other computers, then sold access to those later victims' machines to ransomware attackers.
Removing The Code From Compromised Websites
In its own 12th November account, Denmark's National enhed for Særlig Kriminalitet (NSK) said it and police from other countries had removed malicious code from 681 WordPress websites. It also reported the takedown of 218 domains and 14 servers abroad. Those figures describe the international action reported by NSK, separately from DOJ's count of more than 100 servers.
NSK said investigators believed attackers had entered the websites using stolen passwords obtained through criminal channels, then installed a backdoor, a way to keep accessing the sites. During the operation, Danish police accessed affected websites and removed the attackers' access. They also left messages for website owners with security guidance.
DOJ said the Shadowserver Foundation worked with internet service providers and computer security incident response teams to identify infected systems, help notify victims and assist with clean-up. The department said the action was coordinated with Operation Endgame, an international law enforcement initiative targeting criminal malware services.
NSK's notice urged website owners to change administrator passwords, remove unknown accounts, enable authentication requiring more than a password, and update WordPress, the themes that control its appearance and the plugins that add features.
The DOJ release and NSK notice describe action against the malware's distribution infrastructure, but do not establish whether all infected computers have been cleaned or whether Gootloader has been permanently eliminated.
