Justice Department strips malware blamed for US cyberattacks, seizes web domains that loaded it

article The U.S. Department of Justice said Thursday it has successfully removed a malware blamed on dozens of ransomware attacks from more than 100 servers. (Photo: Bill Hinton/Getty Images) The Brief Federal authorities dismantled the "Gootloader" malware operation, purging the malware from over 100 compromised servers and seizing U.S. domains used to control it. Since 2018, Gootloader has infected at least 25,000 computers globally by tricking users into downloading it. Once infected, those machines turned into a botnet that spreads further infections and sells network access to ransomware groups responsible for attacks on at least 44 U.S. victims. Federal authorities say they have successfully removed the "Gootloader" malware, blamed for ransomware attacks on at least 44 U.S.-based victims, from more than 100 computer servers and have seized U.S. domain names used in related cybercrimes. Big picture view: The U.S. Department of Justice announced Thursday that it, along with the FBI and international partners, had disrupted the international cybercrime operation that involved the malware. The operation was part of "Operation Endgame," a multinational law enforcement operation that targets the dismantling of malware cybercriminal activities. The servers from which Gootloader had been removed included compromised WordPress sites. WordPress, though once associated only with blogging, now serves as the content management system of many different kinds of sites, from news to business to sales. WPZoom estimates that approximately 39.5% of all websites are powered by WordPress. The web domains seized were used by criminals to deliver and control the malware, which the department said has infected at least 25,000 computers around the world since 2018. Newly-unsealed court documents state the malware infects victim computers through a variety of means, often involving tricking unsuspecting people into downloading it. Once the computers are infected, they become part of a network of other compromised computers that work together to help infect other computers, then sell access to those later-infected computers to ransomware attackers. What they're saying: "Using a network of compromised websites, Gootloader malware infected thousands of computers worldwide, providing cybercriminals with access to deploy ransomware and cause millions of dollars in losses," FBI Cyber Branch Operations Director Brett Leatherman said. "Working alongside our partners, we disrupted the Gootloader botnet through coordinated technical operations, victim notifications, and remediation. Strong international and private-sector partnerships made this disruption possible, allowing us to protect victims from further harm and prevent future exploitation." Why you should care: The Shadowserver Foundation worked with internet service providers and cyber security response experts to find systems that were infected, notify victims and help them get rid of the software. Websites seized during Operation Endgame now display this seizure notice. (Photo: U.S. Department of Justice) When a visitor comes to a domain seized during the operation that might otherwise have attempted to compromise their device by uploading the malware, they will now encounter a seizure notice. The Source: Information for this story came from the U.S. Department of Justice and WPZoom. This story was reported from Orlando. Crime and Public Safety