[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbYWGk_B8WqLuKp4nwHoX9wjHP6e5Ilwi_AhAg2j62kM":3},{"article":4,"iocs":43,"watch_terms":64,"solutions":65,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"674e98fe-9c46-4a91-a92f-0be8d99e742b","Gootloader Malware Disrupted After Infecting 25,000 Computers","gootloader-malware-disrupted-after-infecting-25-000-computers-93f9e8","International law enforcement disrupts Gootloader, seizing domains and taking down over 100 servers linked to 25,000 infected computers. The U.S. Department of Justice announced that law enforcement has removed Gootloader malware from more than 100 computer servers, seized U.S. domain names used to deliver and control it, and notified victims worldwide. “The Department of Justice […]","International law enforcement has disrupted the Gootloader malware operation, seizing over 100 servers and U.S. domain names used for control and delivery. Since 2018, Gootloader has infected approximately 25,000 computers globally, often spreading through compromised websites. The malware operates on an access-as-a-service model, selling access to ransomware groups, and has been linked to ransomware attacks causing an estimated $28.8 million in losses to at least 44 U.S. victims.","Gootloader malware operation disrupted, 100+ servers seized, 25,000 computers affected.","https:\u002F\u002Fsecurityaffairs.com\u002F202997\u002Fcyber-crime\u002Fgootloader-malware-disrupted-after-infecting-25000-computers.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-29-1024x576.png","2026-11-13T14:35:44+00:00","2026-11-13T16:00:27.244825+00:00",8,[17],{"name":18,"type":19},"UNC2565","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,31,33,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,47,50,53,56,58,61],{"type":24,"value":45,"context":46},"REvil","Ransomware dropped by Gootloader.",{"type":24,"value":48,"context":49},"Sodinokibi","Alias for REvil ransomware.",{"type":24,"value":51,"context":52},"Gootloader","Malware family disrupted by law enforcement.",{"type":24,"value":54,"context":55},"GootKit","Malware family Gootloader belongs to.",{"type":24,"value":57,"context":46},"SunCrypt",{"type":24,"value":59,"context":60},"Kronos","Trojan dropped by Gootloader.",{"type":24,"value":62,"context":63},"Cobalt Strike","Tool dropped by Gootloader.",[],{"controls":66,"vendors":151},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":97,"name":98,"problem":99,"products":100},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"slug":126,"name":127,"problem":128,"products":129},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[130,138,145],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":142,"url":143,"description":144},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":146,"product_name":147,"url":149,"description":150},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[152],{"slug":153,"name":154,"logo_path":155,"roles":156},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":168},"gootloader-takedown-exposes-risks-of-compromised-websites-and-access-as-a-service-malware","Gootloader Takedown Exposes Risks of Compromised Websites and Access-as-a-Service Malware","Gootloader spread primarily through compromised legitimate websites, tricking users into downloading malicious files—a technique that succeeds when users lack awareness of web-based malware delivery. Operating as an access-as-a-service broker, it lowered the barrier for ransomware groups to launch attacks, amplifying harm far beyond the initial infection. Over six years and 25,000 infections, the operation caused an estimated $28.8 million in losses before law enforcement intervened. This case underscores how malware ecosystems that commoditize initial access can persist and scale when defenders fail to detect infections early or block malicious download behavior. Timely endpoint detection, user education about suspicious downloads, and proactive vulnerability management of web-facing assets are critical defenses.",[163,164,165,166,167],"MITRE ATT&CK T1189: Drive-by Compromise","CIS Control 10: Malware Defenses (v8)","CIS Control 14: Security Awareness and Skills Training (v8)","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events","NIS2 Article 21(2)(g)",{"NIS2 Article 21(2)(g)":169,"CIS Control 10: Malware Defenses (v8)":170,"MITRE ATT&CK T1189: Drive-by Compromise":171,"CIS Control 14: Security Awareness and Skills Training (v8)":172,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":173},"This point requires basic cyber hygiene and cybersecurity training, which would address the user behavior exploited by Gootloader's web-based lure and malicious download delivery mechanism.","CIS Control 10 requires deploying anti-malware tools and behavioral defenses on endpoints, which would have detected and blocked Gootloader's malicious script execution before it established persistence.","Gootloader infected victims by compromising legitimate websites so that visiting users would unknowingly download the malware, which is precisely the technique this ATT&CK entry describes.","CIS Control 14 calls for training users to recognize social engineering and unsafe download behavior, directly addressing the user-facing lure technique Gootloader relied on through fake search results.","Continuous network and endpoint monitoring would have surfaced Gootloader's command-and-control communications earlier, enabling faster response before ransomware groups could leverage the purchased access."]