On Thursday, an international coalition of law enforcement agencies and cybersecurity companies dismantled more than 100 servers used by the StealC password-stealing malware as part of a wider takedown that disrupted 235 servers and 257 domains also used by the Gootloader and CastleRAT malware strains. In a follow up notice on the operation later on Thursday, Assistant Attorney General A. Tysen Duva said the Justice Department removed Gootloader from more than 100 servers, including compromised websites, and seized several domain names that the cybercriminals used to deliver and control the Gootloader malware.
FBI Cyber Branch Operations Director Brett Leatherman said hackers used the network of compromised websites to infect thousands of computers with Gootloader, providing them with the access needed to deploy ransomware. Justice Department officials said Gootloader has existed since 2018 and was used to infect 25,000 devices globally. In court documents unsealed this week, prosecutors said victims typically downloaded Gootloader accidentally, adding their compromised device to a botnet of other infected computers. The hackers then sold access to the network of devices to ransomware gangs.
