Gootloader

Family profile

Gootloader is a JavaScript-based malware delivery framework and initial-access malware operation used to compromise Windows enterprise environments and deliver follow-on payloads including Gootkit, IcedID, Cobalt Strike, Kronos, REvil, and other intrusion tooling. It is widely associated with search-engine poisoning campaigns that lure victims searching for business, legal, or contract-related topics to compromised websites, especially compromised WordPress infrastructure, where fake forum-style pages offer ZIP archives containing malicious JavaScript files named to match the victim’s query. The operation has been characterized as Malware-as-a-Service and Initial Access as a Service because it functions primarily as a distribution and access broker for downstream malware and affiliate intrusion activity.

The infection chain typically begins with SEO poisoning and a landing page on a compromised website. After the victim downloads and executes the JavaScript payload through Windows Script Host, Gootloader runs a heavily obfuscated multi-stage chain that may use additional JavaScript, PowerShell, and registry-resident components. The malware commonly fingerprints the host, including checking whether the system is joined to an Active Directory domain, and selectively retrieves later stages only for desirable enterprise targets. Observed variants have used compromised web infrastructure and WordPress endpoints for command-and-control and host profiling.

Gootloader is designed to minimize disk artifacts and evade detection. Reported behaviors include layered JavaScript obfuscation, delayed execution, in-memory staging, storage of encoded payloads in the Windows registry, scheduled-task persistence, and process hollowing into legitimate Windows processes. Some variants establish persistence immediately, while others first contact remote infrastructure and then stage additional components. Newer variants have also been observed collecting detailed host information such as processes, operating system data, environment variables, desktop items, and drive information, then transmitting that data to help operators decide whether to deploy additional malware.

Post-compromise activity linked to Gootloader infections includes deployment of Cobalt Strike and SystemBC, credential access, LDAP and Active Directory discovery, lateral movement via SMB, WMI, WinRM, remote services, and RDP, as well as exfiltration of sensitive files in some incidents. Targeting has included business professionals and organizations in sectors such as legal services, healthcare, finance, pharmaceutical, energy, automotive, military, and government across North America, Europe, and parts of Asia. Gootloader remains notable for combining effective social-engineering lures, compromised legitimate websites, selective enterprise targeting, and fileless staging to provide reliable initial access for financially motivated intrusion operations.

Capabilities

Credential Theft
Defense Evasion
Exfiltration
Initial Access
Lateral Movement
Persistence
Post Exploitation
Process Injection
Reconnaissance

Reported operators

Threat actors

6 named in public reporting

UNC2565

During the month of December 2022, the Cybereason Incident Response (IR) team investigated an incident which involved new deployment methods of GootLoader... GootLoader targets companies in English-speaking countries... targeted attacks have been more prominent against healthcare and finance organizations.

Lure Marauder

While the Lorem Ipsum and Gootloader chains are technically distinct, the shared reliance on compromised WordPress infrastructure suggests either common access broker sources, shared compromise tooling, or operator-level coordination between the two pipelines.

Rapid Brigantine

Vanilla Tempest

Rhysida actors, operating under the Vanilla Tempest cluster, have used Gootloader-based access that hands off to Supper before ransomware is deployed.

Storm-0494

During the attack, Vanilla Tempest gained network access through the Storm-0494 threat actor, who infected the victim's systems with the Gootloader malware downloader.

Hive0127

GootLoader, a JavaScript-based malware loader, returned with new obfuscation techniques. It uses custom WOFF2 fonts and exploits WordPress comment sections to deliver malicious payloads.

MITRE ATT&CK

Gootloader in ATT&CK

65 distinct techniques

Techniques

65 techniques

T1584 Compromise Infrastructure T1189 Drive-by Compromise T1608.006 SEO Poisoning T1059.007 JavaScript T1027.011 Fileless Storage T1112 Modify Registry T1204 User Execution T1105 Ingress Tool Transfer T1036 Masquerading T1204.002 Malicious File T1071 Application Layer Protocol T1584.004 Server T1027 Obfuscated Files or Information T1505.003 Web Shell T1027.010 Command Obfuscation T1497 Virtualization/Sandbox Evasion T1055.012 Process Hollowing T1583 Acquire Infrastructure T1620 Reflective Code Loading T1497.001 System Checks T1053 Scheduled Task/Job T1059.001 PowerShell T1566 Phishing T1547.001 Registry Run Keys / Startup Folder T1566.002 Spearphishing Link T1071.001 Web Protocols T1564.001 Hidden Files and Directories T1053.005 Scheduled Task T1059.006 Python T1132 Data Encoding T1082 System Information Discovery T1083 File and Directory Discovery T1059 Command and Scripting Interpreter T1120 Peripheral Device Discovery T1057 Process Discovery T1059.005 Visual Basic T1140 Deobfuscate/Decode Files or Information T1041 Exfiltration Over C2 Channel T1008 Fallback Channels T1190 Exploit Public-Facing Application T1547.009 Shortcut Modification T1056 Input Capture T1568 Dynamic Resolution T1001 Data Obfuscation T1539 Steal Web Session Cookie T1016 System Network Configuration Discovery T1505 Server Software Component T1078 Valid Accounts T1027.009 Embedded Payloads T1592 Gather Victim Host Information T1567 Exfiltration Over Web Service T1497.003 Time Based Checks T1614.001 System Language Discovery T1590 Gather Victim Network Information T1037.001 Logon Script (Windows) T1583.001 Domains T1069.002 Domain Groups T1482 Domain Trust Discovery T1566.001 Spearphishing Attachment T1584.006 Web Services T1204.001 Malicious Link T1614 System Location Discovery T1584.001 Domains T1132.001 Standard Encoding T1055.002 Portable Executable Injection

Reporting

Research mentioning Gootloader

Aug 11

Lazarusholic Bluesky

Post by @lazarusholic.bsky.social - Bluesky

A Sonatype report identified six malicious npm packages that used Ethereum transactions to retrieve and stage malicious payloads, an unusual delivery method that obscures second-stage infrastructure behind blockchain activity. The campaign was linked in public reporting to ContagiousInterview and NullReceiver, indicating continued abuse of the JavaScript and Node.js ecosystem for software supply-chain compromise. The activity aligns with broader attacker tradecraft documented for MITRE ATT&CK T1059.007 (Command and Scripting Interpreter: JavaScript), which covers JavaScript and Node.js use for payload delivery, execution, reconnaissance, and command-and-control. Defenders monitoring follow-on behavior should watch for suspicious child-process activity and discovery commands launched from non-shell parent processes, a pattern reflected in Splunk detection guidance for tools such as ipconfig.exe, systeminfo.exe, net.exe, and whoami.exe executed outside normal cmd.exe or PowerShell chains.

May 13

Splunk Research

Detection: Cmdline Tool Not Executed In CMD Shell | Splunk Security Content

Jan 1

Sophos Threat Research

A new APT uses DLL side-loads to “KilllSomeOne” | SOPHOS

Sophos has identified a new PlugX USB worm variant spreading through removable media in outbreaks across Papua New Guinea, Ghana, Mongolia, Zimbabwe, and Nigeria, using DLL sideloading with legitimate AvastSvc.exe, a malicious wsc.dll, and an encrypted PlugX payload. The malware hides files on infected USB drives, gathers host reconnaissance, and steals Office and PDF documents up to 300 MB, storing them in encrypted form under RECYCLER.BIN with base64-obfuscated filenames before attempting exfiltration to infrastructure including 45.142.166[.]112. The activity aligns with the long-running PKPLUG espionage cluster, which researchers have previously attributed with high confidence to a Chinese nation-state adversary targeting victims in and around Southeast Asia, including Xinjiang, Mongolia, Myanmar, and Taiwan. Earlier reporting tied PKPLUG to malware families including PlugX, Poison Ivy, 9002, Zupdax, Farseer, and the Android spyware HenBox, and documented overlapping infrastructure, DLL sideloading, registry-based persistence, and surveillance-focused collection against regional targets, reinforcing the assessment that the new worm is part of a broader intelligence-gathering campaign.

Jan 1

Sophos Threat Research

A border-hopping PlugX USB worm takes its act on the road | SOPHOS

Jan 1

Sophos Threat Research

“Gootloader” expands its payload delivery options | SOPHOS

Attackers operating the Gootkit loader compromised legitimate websites and used SEO poisoning to lure users searching for legal document templates into downloading malicious ZIP archives. The archives contained JavaScript that, once executed, launched obfuscated PowerShell and began a multi-stage infection chain designed to avoid writing the final payload to disk. Trend Micro reported that the updated intrusion flow used registry stuffing, scheduled-task persistence, and reflective in-memory loading to reconstruct and run a fileless Cobalt Strike beacon. The campaign differed from earlier Gootkit activity by shifting from freeware-themed lures to legal-document themes and by encrypting registry-stored content with a custom text-replacement algorithm instead of Base64; in the observed case, the beacon communicated with 89.238.185.13 before the attack was interrupted.

Feb 26

Dfir Report