Gootloader returns with enhanced obfuscation techniques.

Du'aine Davis

Observed in the wild

• On 5 November, Huntress reported a resurgence of Gootloader malware, with three infections observed since 27 October. Two cases escalated to hands-on-keyboard intrusions, including Domain Controller compromise within 17 hours. Targets were lured via SEO poisoning to compromised WordPress sites, where fake document downloads triggered malicious JavaScript payloads. The threat actor Storm-0494 facilitated access for Vanilla Tempest, who deployed ransomware and the Supper SOCKS5 backdoor.
• Gootloader abuses WordPress comment endpoints to deliver XOR-encrypted ZIP payloads, obfuscated using custom WOFF2 fonts and short filenames. It is operated by Storm-0494, who hands off access to Vanilla Tempest. Vanilla Tempest deploys the Supper SOCKS5 backdoor, which uses API hammering, shellcode injection, and custom encryption to enable remote control, lateral movement, and data exfiltration.
• Organisations are advised to monitor for early indicators such as unusual PowerShell activity, AD enumeration, WinRM lateral movement, and privilege escalation. Microsoft Defender users should focus on detecting behaviours like shortcut file persistence (T1547.001), Volume Shadow Copy enumeration, and obfuscated JavaScript execution masquerading as jQuery. 

Gootloader | Threat Detection Overview | Huntress