Skip to content
International Crackdown on Gootloader Malware in Operation Endgame

International Crackdown on Gootloader Malware in Operation Endgame

First seen 14 Nov 2026, 12:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 12:15 UTC
  • •Operation Endgame targets the Gootloader malware used for unauthorized system access.
  • •672 infected websites were remediated globally, including 24 in Canada.
  • •The RCMP developed a disinfection tool shared with international partners.

Operation Endgame, led by the RCMP in Canada and supported by international partners, has targeted the Gootloader malware, which facilitates unauthorized access to systems via compromised WordPress sites. The operation involved law enforcement from Denmark, the Netherlands, the U.S., Germany, and the U.K. Over the week of November 9, 672 infected websites were remediated globally, with 24 of those in Canada. The RCMP's Cybercrime Investigation Team developed a disinfection tool that was shared with partners to combat the malware. Gootloader is known for masquerading as legal documents to trick users into downloading malware. This operation marks a significant collaborative effort against cybercrime, emphasizing the importance of international cooperation in cybersecurity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 12h ago How this analysis works

Timeline

2026-11-09
Global action week begins
Law enforcement agencies participated in a coordinated effort to combat Gootloader malware, deploying a disinfection tool.
Sherepunjabradio.Ca
2026-11-13
RCMP announces Operation Endgame details
The RCMP confirmed their role in the international operation targeting Gootloader malware, detailing their contributions and achievements.
Oakbaynews
2026-11-14
Operation Endgame reported
The operation's success was highlighted, with a focus on the international collaboration and the number of compromised sites remediated.
Sherepunjabradio.Ca

More articles in this cluster (4)

Following this threat?

Track Gootloader and Eurojust in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 2

Common questions

What is Gootloader malware?
Gootloader is a malware that enables unauthorized access to systems by using compromised websites, often disguised as legal documents.
How many websites were affected?
Approximately 672 infected websites were remediated globally during Operation Endgame.
What actions should organizations take?
Organizations should ensure their systems are not using compromised WordPress sites and consider implementing the disinfection tool developed by the RCMP.