GootLoader
¿Qué es GootLoader?
GootLoaderA long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates.
GootLoader is a JavaScript-based malware loader, active since 2020 and tracked by Mandiant as part of the UNC2565 cluster, evolved from the older Gootkit banking trojan codebase. Its hallmark distribution technique is SEO poisoning: operators compromise WordPress sites and stuff them with realistic-looking pages such as 'free contract template', 'NDA sample', or 'agreement form X PDF', often topping Google results for niche legal-document queries. Victims who download the 'document' actually receive a ZIP containing a JavaScript that, on execution via WSH, deploys a heavily obfuscated multi-stage loader with .NET and PowerShell components. Subsequent payloads have included REvil, Cobalt Strike, IcedID, BlackCat, and other ransomware affiliates' tools, making GootLoader a persistent initial-access pipeline for the broader RaaS ecosystem. Defenses focus on web-content filtering of newly registered or low-reputation domains hosting SEO-poisoned content, blocking WSH execution of `.js` from user folders, and EDR detection on the loader's stable PowerShell command lines.
● Ejemplos
- 01
A paralegal Googles 'sample independent contractor agreement template' and downloads a `.zip` from a compromised dentistry blog, kicking off the GootLoader chain.
- 02
An EDR rule flags wscript.exe spawning an outbound HTTPS connection from `%AppData%\Roaming\<random>\` — the canonical GootLoader stage.
● Preguntas frecuentes
¿Qué es GootLoader?
A long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates. Pertenece a la categoría de Malware en ciberseguridad.
¿Qué significa GootLoader?
A long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates.
¿Cómo funciona GootLoader?
GootLoader is a JavaScript-based malware loader, active since 2020 and tracked by Mandiant as part of the UNC2565 cluster, evolved from the older Gootkit banking trojan codebase. Its hallmark distribution technique is SEO poisoning: operators compromise WordPress sites and stuff them with realistic-looking pages such as 'free contract template', 'NDA sample', or 'agreement form X PDF', often topping Google results for niche legal-document queries. Victims who download the 'document' actually receive a ZIP containing a JavaScript that, on execution via WSH, deploys a heavily obfuscated multi-stage loader with .NET and PowerShell components. Subsequent payloads have included REvil, Cobalt Strike, IcedID, BlackCat, and other ransomware affiliates' tools, making GootLoader a persistent initial-access pipeline for the broader RaaS ecosystem. Defenses focus on web-content filtering of newly registered or low-reputation domains hosting SEO-poisoned content, blocking WSH execution of `.js` from user folders, and EDR detection on the loader's stable PowerShell command lines.
¿Cómo defenderse de GootLoader?
Las defensas contra GootLoader combinan habitualmente controles técnicos y prácticas operativas, como se detalla en la definición.
¿Cuáles son otros nombres para GootLoader?
Nombres alternativos comunes: GootKit Loader, UNC2565.
● Términos relacionados
- malware№ 692
Loader
Malware que prepara el entorno y carga cargas posteriores —a menudo directamente en memoria— para la siguiente fase de un ataque.
- defense-ops№ 597
Initial Access Broker (IAB)
Especialista del cibercrimen que obtiene acceso no autorizado a redes corporativas y lo vende a otros delincuentes, sobre todo a afiliados de ransomware.
- malware№ 1006
Ransomware como servicio (RaaS)
Modelo de negocio criminal en el que los operadores de ransomware alquilan su malware e infraestructura a afiliados, que ejecutan los ataques y comparten las ganancias.
- defense-ops№ 215
Cobalt Strike
Plataforma comercial de simulacion adversaria ampliamente usada en operaciones de red team y frecuentemente abusada por atacantes para post-explotacion y mando y control.
- malware№ 564
IcedID / BokBot
Troyano bancario modular y cargador visto por primera vez en 2017 que se convirtio en precursor principal de despliegues de ransomware de grupos como Conti y Quantum.
- attacks№ 398
Drive-by download
Ataque en el que se instala malware silenciosamente en el dispositivo de la víctima por el mero hecho de visitar un sitio web comprometido o malicioso.