GootLoader
Qu'est-ce que GootLoader ?
GootLoaderA long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates.
GootLoader is a JavaScript-based malware loader, active since 2020 and tracked by Mandiant as part of the UNC2565 cluster, evolved from the older Gootkit banking trojan codebase. Its hallmark distribution technique is SEO poisoning: operators compromise WordPress sites and stuff them with realistic-looking pages such as 'free contract template', 'NDA sample', or 'agreement form X PDF', often topping Google results for niche legal-document queries. Victims who download the 'document' actually receive a ZIP containing a JavaScript that, on execution via WSH, deploys a heavily obfuscated multi-stage loader with .NET and PowerShell components. Subsequent payloads have included REvil, Cobalt Strike, IcedID, BlackCat, and other ransomware affiliates' tools, making GootLoader a persistent initial-access pipeline for the broader RaaS ecosystem. Defenses focus on web-content filtering of newly registered or low-reputation domains hosting SEO-poisoned content, blocking WSH execution of `.js` from user folders, and EDR detection on the loader's stable PowerShell command lines.
● Exemples
- 01
A paralegal Googles 'sample independent contractor agreement template' and downloads a `.zip` from a compromised dentistry blog, kicking off the GootLoader chain.
- 02
An EDR rule flags wscript.exe spawning an outbound HTTPS connection from `%AppData%\Roaming\<random>\` — the canonical GootLoader stage.
● Questions fréquentes
Qu'est-ce que GootLoader ?
A long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates. Cette notion relève de la catégorie Logiciels malveillants en cybersécurité.
Que signifie GootLoader ?
A long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates.
Comment fonctionne GootLoader ?
GootLoader is a JavaScript-based malware loader, active since 2020 and tracked by Mandiant as part of the UNC2565 cluster, evolved from the older Gootkit banking trojan codebase. Its hallmark distribution technique is SEO poisoning: operators compromise WordPress sites and stuff them with realistic-looking pages such as 'free contract template', 'NDA sample', or 'agreement form X PDF', often topping Google results for niche legal-document queries. Victims who download the 'document' actually receive a ZIP containing a JavaScript that, on execution via WSH, deploys a heavily obfuscated multi-stage loader with .NET and PowerShell components. Subsequent payloads have included REvil, Cobalt Strike, IcedID, BlackCat, and other ransomware affiliates' tools, making GootLoader a persistent initial-access pipeline for the broader RaaS ecosystem. Defenses focus on web-content filtering of newly registered or low-reputation domains hosting SEO-poisoned content, blocking WSH execution of `.js` from user folders, and EDR detection on the loader's stable PowerShell command lines.
Comment se défendre contre GootLoader ?
Les défenses contre GootLoader combinent habituellement des contrôles techniques et des pratiques opérationnelles, comme détaillé dans la définition ci-dessus.
Quels sont les autres noms de GootLoader ?
Noms alternatifs courants : GootKit Loader, UNC2565.
● Termes liés
- malware№ 692
Loader
Malware qui prépare l'environnement et charge des charges utiles ultérieures — souvent directement en mémoire — pour la phase suivante d'une attaque.
- defense-ops№ 597
Initial Access Broker (IAB)
Specialiste cybercriminel qui obtient des acces non autorises a des reseaux d'entreprises et les revend a d'autres criminels, principalement aux affilies de ransomware.
- malware№ 1006
Ransomware-as-a-Service (RaaS)
Modèle économique criminel dans lequel les opérateurs de rançongiciel louent leur malware et leur infrastructure à des affiliés qui mènent les attaques et partagent les gains.
- defense-ops№ 215
Cobalt Strike
Plateforme commerciale de simulation d'adversaire tres utilisee par les red teams et frequemment detournee par des attaquants pour le post-exploitation et le command-and-control.
- malware№ 564
IcedID / BokBot
Cheval de Troie bancaire modulaire et loader apparu en 2017, devenu un precurseur frequent des deploiements de ransomware par des groupes comme Conti et Quantum.
- attacks№ 398
Téléchargement furtif (drive-by download)
Attaque où un malware est installé silencieusement sur l'appareil de la victime simplement parce qu'elle visite un site compromis ou malveillant.