Canada: RCMP Disinfects 24 Machines in Global Malware Crackdown

The RCMP says its Vancouver cybercrime team disinfected 24 compromised machines in Canada during an international action against Gootloader, a Russia-based malware. The action took place during the week of Nov. 9, 2026, and addressed about 672 infected websites worldwide.

Gootloader enables unauthorized access to computer systems through compromised websites, according to the RCMP. Police said it used infected WordPress sites to spread malware disguised as legal documents.

The Vancouver team and the RCMP's Cyber and Technical Investigation Service developed a tool to remove Gootloader from infected machines. The RCMP said the tool was shared with partners in Operation Endgame, the international joint operation targeting initial access malware.

During the action week, law enforcement agencies in Canada, Denmark, the Netherlands and the United States deployed the tool, police said.

International operation

The RCMP said its Vancouver cybercrime team is the lead Canadian police agency and national representative in Operation Endgame. It contributed coders, analysts and investigators to the project. Vancouver investigators also took part in the action week at Europol headquarters in The Hague, Netherlands.

The Gootloader action involved authorities from Canada, Denmark, the Netherlands, the United States, Germany and the United Kingdom, according to the RCMP.

Operation Endgame is an ongoing international joint operation supported by Europol and Eurojust. The RCMP said it brings together agencies from countries including Bulgaria, Canada, Denmark, Germany, the Netherlands, Poland, the United Kingdom and the United States.