Federal enforcers spent the week taking down the access brokers

The botnet that sold the way in

The Department of Justice removed Gootloader malware from over 100 computer servers and seized U.S. domain names used by criminals to control Gootloader, in an international operation against a botnet whose business was access itself. Gootloader infects computers by tricking individuals into downloading the malware, and the Gootloader botnet sells access to infected computers to ransomware actors. The operators did not need to run the ransomware themselves. They sold the door, and someone else walked through it. m:…5526

The scale is what makes the case worth reading. Gootloader has infected at least 25,000 computers worldwide since 2018, and Gootloader-linked ransomware attacks have caused approximately $28.8 million in losses for at least 44 U.S. victims. The malware targeted the U.S. Department of War and the Defense Industrial Base, which is presumably why the investigation was led by DCIS, the FBI's Denver Field Office, and the Army Criminal Investigative Division, working with international partners including Europol and the BKA. The Shadowserver Foundation assisted in identifying infected systems and notifying victims, which is the unglamorous half of a takedown: finding the people whose machines were conscripted and telling them. m:…5526

The operation sits inside Operation Endgame, a multinational initiative targeting the dismantling of malware cybercriminal services. The Justice Department's Computer Crime and Intellectual Property Section notes that since 2020 it has secured the conviction of over 220 cyber and intellectual property criminals, and court orders for the return of over $500 million in victim funds. The Gootloader action fits that pattern: take the infrastructure, not just the individual, and count the recovery in money returned rather than headlines generated. m:…5526

The markets that sold the drugs

The same logic runs through Operation TorNado, announced by the Department of Justice and Europol. The operation targets criminal enterprises using dark-web markets to traffic fentanyl, opioids, and other illicit drugs, and it resulted in over 350 arrests worldwide. A dark-web market is a middleman in the same sense Gootloader was: it does not produce the drugs, it provides the meeting place, the reputation system, and the payment rails, and it takes its cut from every transaction. m:…5525

The seizures tell the story of what the markets were moving: drugs, weapons, and over $234 million. The number that matters for anyone assessing the operation is the arrest count, because 350 arrests across multiple countries is a coordinated sweep rather than a single bust, and the money figure suggests the markets were moving serious volume. The open question, as with every market takedown, is whether the demand finds a new meeting place, which is why the operation's value will be measured in what happens next rather than in the announcement. m:…5525

The filings desk that sold the tip

The week's market cases follow the same shape, at a smaller scale and with a different kind of access. The SEC charged Chetram Balli with insider trading, alleging he traded on material nonpublic information on at least eight occasions between May 2025 and October 2026. Balli was employed as a document processing specialist at a large international law firm, which is to say his job put him next to other people's confidential deals. He allegedly generated approximately $55,000 in ill-gotten profits, and he faces a parallel criminal action brought by the U.S. Attorney's Office for the Eastern District of New York. The charge is insider trading under Section 10(b) of the Securities Exchange Act of 1934 and Rule 10b-5. m:…2220

The second case is the larger one, and it is already resolved. The U.S. District Court for the Eastern District of New York entered a final consent judgment against Jun Zhen on November 9, 2026. Zhen and a colleague were employed by a company that assisted clients with public filings in the SEC's EDGAR system, and they obtained material nonpublic information about clients' forthcoming announcements, including mergers and earnings results. Between January 2025 and June 2025, they traded on that information on at least 13 occasions, and the scheme generated more than $2.2 million in ill-gotten profits. The final judgment ordered Zhen to pay $500,619 in disgorgement and $8,832 in prejudgment interest, satisfied by the forfeiture order in the parallel criminal action, United States v. Chen and Zhen. m:…2221

The detail that ties the two market cases together is how they were caught. The SEC's Market Abuse Unit used Consolidated Audit Trail data to analyze the suspicious trading activity in the Zhen case, and the SEC's investigation used the same CAT data in the Balli case. The audit trail is the point. Both men held jobs that gave them legitimate access to confidential information, and the trading data showed what they did with it. For any firm whose staff handle client filings, the lesson is plain: the access is the risk, and the audit trail is now good enough to find the trades. That is the common thread of the week. The enforcers did not chase the end users. They went after the people who sold the way in. m:…2221 m:…2220