GootLoader
Was ist GootLoader?
GootLoaderA long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates.
GootLoader is a JavaScript-based malware loader, active since 2020 and tracked by Mandiant as part of the UNC2565 cluster, evolved from the older Gootkit banking trojan codebase. Its hallmark distribution technique is SEO poisoning: operators compromise WordPress sites and stuff them with realistic-looking pages such as 'free contract template', 'NDA sample', or 'agreement form X PDF', often topping Google results for niche legal-document queries. Victims who download the 'document' actually receive a ZIP containing a JavaScript that, on execution via WSH, deploys a heavily obfuscated multi-stage loader with .NET and PowerShell components. Subsequent payloads have included REvil, Cobalt Strike, IcedID, BlackCat, and other ransomware affiliates' tools, making GootLoader a persistent initial-access pipeline for the broader RaaS ecosystem. Defenses focus on web-content filtering of newly registered or low-reputation domains hosting SEO-poisoned content, blocking WSH execution of `.js` from user folders, and EDR detection on the loader's stable PowerShell command lines.
● Beispiele
- 01
A paralegal Googles 'sample independent contractor agreement template' and downloads a `.zip` from a compromised dentistry blog, kicking off the GootLoader chain.
- 02
An EDR rule flags wscript.exe spawning an outbound HTTPS connection from `%AppData%\Roaming\<random>\` — the canonical GootLoader stage.
● Häufige Fragen
Was ist GootLoader?
A long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates. Es gehört zur Kategorie Schadsoftware der Cybersicherheit.
Was bedeutet GootLoader?
A long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates.
Wie funktioniert GootLoader?
GootLoader is a JavaScript-based malware loader, active since 2020 and tracked by Mandiant as part of the UNC2565 cluster, evolved from the older Gootkit banking trojan codebase. Its hallmark distribution technique is SEO poisoning: operators compromise WordPress sites and stuff them with realistic-looking pages such as 'free contract template', 'NDA sample', or 'agreement form X PDF', often topping Google results for niche legal-document queries. Victims who download the 'document' actually receive a ZIP containing a JavaScript that, on execution via WSH, deploys a heavily obfuscated multi-stage loader with .NET and PowerShell components. Subsequent payloads have included REvil, Cobalt Strike, IcedID, BlackCat, and other ransomware affiliates' tools, making GootLoader a persistent initial-access pipeline for the broader RaaS ecosystem. Defenses focus on web-content filtering of newly registered or low-reputation domains hosting SEO-poisoned content, blocking WSH execution of `.js` from user folders, and EDR detection on the loader's stable PowerShell command lines.
Wie schützt man sich gegen GootLoader?
Schutzmaßnahmen gegen GootLoader kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für GootLoader?
Übliche alternative Bezeichnungen: GootKit Loader, UNC2565.
● Verwandte Begriffe
- malware№ 692
Loader
Schadsoftware, die die Umgebung vorbereitet und weitere Nutzlasten — oft direkt im Speicher — für die nächste Phase eines Angriffs lädt.
- defense-ops№ 597
Initial Access Broker (IAB)
Cybercrime-Spezialist, der unautorisierten Zugriff auf Unternehmensnetzwerke beschafft und an andere Kriminelle, vor allem Ransomware-Affiliates, verkauft.
- malware№ 1006
Ransomware-as-a-Service (RaaS)
Ein kriminelles Geschäftsmodell, bei dem Ransomware-Betreiber ihre Malware und Infrastruktur an Affiliates vermieten, die die Angriffe ausführen und die Beute teilen.
- defense-ops№ 215
Cobalt Strike
Eine kommerzielle Adversary-Simulation-Plattform, die in Red-Team-Operationen weit verbreitet ist und von Angreifern haeufig fuer Post-Exploitation und Command-and-Control missbraucht wird.
- malware№ 564
IcedID / BokBot
Modularer Banking-Trojaner und Loader, erstmals 2017 gesichtet, der zum haeufigen Vorlaeufer von Ransomware-Operationen wie Conti und Quantum wurde.
- attacks№ 398
Drive-by-Download
Angriff, bei dem allein das Aufrufen einer kompromittierten oder bösartigen Website ausreicht, um auf dem Gerät des Opfers heimlich Schadsoftware zu installieren.