An investigation that began with the FBI’s Cyber Squad in Denver has helped trigger a sweeping international crackdown on Gootloader, a malware loader that installs other malware worldwide. The bureau’s Denver field office announced the disruption Thursday, framing the local probe as the spark behind a much larger coordinated law enforcement strike.
“Gootloader malware has been disrupted around the world in an international cyber operation made possible because of an investigation begun by the FBI Denver Cyber Squad,” FBI Denver
said in a social media post announcing the news. The bureau pointed to a U.S. Department of Justice news release for further detail. According to a snippet from the
U.S. Department of Justice
, the Gootloader investigation was led by the Defense Criminal Investigative Service, the FBI’s Denver Field Office and the Army Criminal Investigative Division, working alongside international partners including Germany’s federal police.
The Gootloader action was one piece of a far bigger sweep. As reported by BleepingComputer, authorities seized 257 domains and 235 servers tied to the Gootloader, CastleRAT and StealC malware operations. Help Net Security reported that the operation involved more than 6 million stolen credentials. The same BleepingComputer report notes the action drew in law enforcement agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States.
How Gootloader Spread Through Hacked Websites
Gootloader itself is described as a malware loader that has been active since 2020, per BleepingComputer’s reporting. Its operators planted fake legal documents on compromised websites, often hacked WordPress sites, according to Help Net Security — a tactic designed to lure unsuspecting visitors searching for contracts or legal templates into downloading infected files.
Specific to the Gootloader piece of the sweep, Operation Endgame’s own site reports that 14 servers and 218 domains were taken down, with 681 infected websites remediated.
Part of a Longer-Running Global Crackdown
This isn’t the first time Operation Endgame has made headlines. The multinational effort has targeted cybercrime since 2024, with CyberScoop describing its focus as removing malware that serves as the foundation for a large number of financially motivated crimes. Earlier stages of the campaign have racked up similarly large numbers: a previous June stage cleaned nearly 15,000 malware-infected WordPress websites and seized 106 servers used by the SocGholish botnet and Evil Corp, per BleepingComputer’s reporting.
The dossier of evidence behind this week’s announcement does not establish whether any victims or infected systems were located in the Denver area specifically, even though the investigation that helped unlock the broader international case began with the bureau’s Denver Cyber Squad. For now, federal officials are framing the disruption as a win against infrastructure that enabled a wide range of downstream, financially motivated cybercrime — the kind that, per Operation Endgame’s own tally, touched well over 200 domains and hundreds of compromised websites before agents stepped in.
