On 12 November 2026 the US Justice Department announced the removal of the Gootloader malware loader from more than 100 servers, including compromised WordPress sites, plus the seizure of US domain names. The action was run in coordination with Operation Endgame. The wider Endgame action covered Gootloader, CastleRAT and StealC. Its published tally was 235 servers and 257 domains.
What the operation did
The DOJ says Gootloader has infected at least 25,000 computers worldwide since 2018. It says the loader was used in ransomware attacks on at least 44 US victims, with approximately $28.8 million in losses. According to The Record's report, victims typically downloaded the malware by accident. Their machines joined a botnet, and operators then sold that access to ransomware gangs.
The Endgame site breaks the numbers down by family:
- Gootloader: 14 servers and 218 domains taken down, and 681 infected websites remediated.
- CastleRAT: 120 servers and 39 domains seized.
- StealC: 102 servers dismantled, which the site describes as a continuation of efforts from June 2026.
The operation also identified over 6 million victim credentials.
The release says the DOJ acted "with court authorization" and on warrants unsealed that week. Partners included Germany's BKA, the Dutch National High Tech Crime Unit, the UK National Crime Agency, the Australian Federal Police, the RCMP and Europol. The release also credits private and non-profit contributors, among them Fraunhofer FKIE, the Registrar of Last Resort, OpenAI and Sharktech.
The strongest case for aggressive disruption
The case for this kind of action is real. A loader is the cheapest link in the ransomware chain to attack. It sits upstream of the extortion, and the same access gets resold repeatedly. Victims of a drive-by download cannot be expected to know they are enrolled in a botnet. Cleaning infected sites, seizing the control domains and notifying victims helps people who could not have protected themselves. The FBI's Brett Leatherman credited "coordinated technical operations, victim notifications, and remediation." The $28.8 million loss figure is also only the documented US ransomware cost, not the full harm.
Why this model deserves support
Our view is that this is how internet-wide cybercrime should be policed. The operation shows four features that a pro-innovation, pro-speech approach should want.
- Judicial authorization. Seizures ran through warrants issued by a court. They did not rest on an administrative blocking order or an agency's discretion. That distinction matters for the open internet. Systems that let regulators remove content or infrastructure without a judge tend to expand to speech they were never meant to cover.
- A narrow technical target. The action went after malware delivery and command-and-control infrastructure, not platforms, publishers or general-purpose tools. The remediation of 681 infected sites also suggests the aim was restoring legitimate sites to their owners, not shutting them down.
- Cooperation instead of unilateral reach. Agencies in at least eight countries took part. That is the practical alternative to the extraterritorial claims that fragment the internet.
- Victim notification. The Record reports that the Shadowserver Foundation worked with ISPs and national incident-response teams to identify infected systems and notify victims. Cleanup, not just seizure, is the real measure of harm reduction.
Where the model strains
The operation still raises questions that policymakers should keep asking.
Transparency. The release names the District of Colorado as the lead US district. It does not, in the version we reviewed, identify the court or a case number. That is normal for a same-week press release, but the warrants should be findable. Legitimate WordPress owners whose sites were cleaned have a particular interest in knowing what was done to their servers.
Private-sector reliance. The release credits technical help from companies and non-profits, including a registrar of last resort. Voluntary partnerships are efficient. They also create informal power over infrastructure, so published scopes of what partners may do would keep that power accountable.
Durability. This is the weakest point. The StealC infrastructure had already been hit in June 2026, and the Endgame site describes the November action as a continuation. Operations since 2024 have repeatedly hit loaders and infostealers, and the families keep returning. Takedowns raise criminals' costs and buy time. They do not remove the demand for access that makes loaders profitable. The reports we reviewed describe infrastructure removal. We found no arrests in them.
What policymakers should do with this
The lesson is not that governments need broader powers. Endgame operates inside existing warrant and mutual-legal-assistance frameworks, and it works. The proportionate path is to fund and speed those channels, not to bolt on new intermediary mandates.
Three steps would help:
- Publish seizure warrants and scope statements promptly, so courts and the public can check what was seized.
- Invest in victim-side fixes. That means support for small-site owners, who run most of the compromised WordPress installations, and for the notification pipelines that clean infected endpoints.
- Measure outcomes beyond server counts, such as time-to-reinfection and credential-reuse rates.
The Gootloader action is a useful template. It was judicially authorized, narrowly aimed and multilateral. Its success should be judged by whether the same families are back in six months.