GootLoader
O que é GootLoader?
GootLoaderA long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates.
GootLoader is a JavaScript-based malware loader, active since 2020 and tracked by Mandiant as part of the UNC2565 cluster, evolved from the older Gootkit banking trojan codebase. Its hallmark distribution technique is SEO poisoning: operators compromise WordPress sites and stuff them with realistic-looking pages such as 'free contract template', 'NDA sample', or 'agreement form X PDF', often topping Google results for niche legal-document queries. Victims who download the 'document' actually receive a ZIP containing a JavaScript that, on execution via WSH, deploys a heavily obfuscated multi-stage loader with .NET and PowerShell components. Subsequent payloads have included REvil, Cobalt Strike, IcedID, BlackCat, and other ransomware affiliates' tools, making GootLoader a persistent initial-access pipeline for the broader RaaS ecosystem. Defenses focus on web-content filtering of newly registered or low-reputation domains hosting SEO-poisoned content, blocking WSH execution of `.js` from user folders, and EDR detection on the loader's stable PowerShell command lines.
● Exemplos
- 01
A paralegal Googles 'sample independent contractor agreement template' and downloads a `.zip` from a compromised dentistry blog, kicking off the GootLoader chain.
- 02
An EDR rule flags wscript.exe spawning an outbound HTTPS connection from `%AppData%\Roaming\<random>\` — the canonical GootLoader stage.
● Perguntas frequentes
O que é GootLoader?
A long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates. Pertence à categoria Malware da cibersegurança.
O que significa GootLoader?
A long-running JavaScript-based initial-access loader operated by UNC2565, dropped via SEO-poisoned legal/contract template downloads and used to stage REvil, Cobalt Strike, IcedID, and ransomware affiliates.
Como funciona GootLoader?
GootLoader is a JavaScript-based malware loader, active since 2020 and tracked by Mandiant as part of the UNC2565 cluster, evolved from the older Gootkit banking trojan codebase. Its hallmark distribution technique is SEO poisoning: operators compromise WordPress sites and stuff them with realistic-looking pages such as 'free contract template', 'NDA sample', or 'agreement form X PDF', often topping Google results for niche legal-document queries. Victims who download the 'document' actually receive a ZIP containing a JavaScript that, on execution via WSH, deploys a heavily obfuscated multi-stage loader with .NET and PowerShell components. Subsequent payloads have included REvil, Cobalt Strike, IcedID, BlackCat, and other ransomware affiliates' tools, making GootLoader a persistent initial-access pipeline for the broader RaaS ecosystem. Defenses focus on web-content filtering of newly registered or low-reputation domains hosting SEO-poisoned content, blocking WSH execution of `.js` from user folders, and EDR detection on the loader's stable PowerShell command lines.
Como se defender contra GootLoader?
As defesas contra GootLoader costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para GootLoader?
Nomes alternativos comuns: GootKit Loader, UNC2565.
● Termos relacionados
- malware№ 692
Loader
Malware que prepara o ambiente e carrega cargas posteriores — frequentemente diretamente em memória — para a fase seguinte de um ataque.
- defense-ops№ 597
Initial Access Broker (IAB)
Especialista cibercriminoso que obtem acesso nao autorizado a redes empresariais e o vende a outros criminosos, sobretudo afiliados de ransomware.
- malware№ 1006
Ransomware como serviço (RaaS)
Modelo de negócio criminoso em que os operadores de ransomware alugam o seu malware e infraestrutura a afiliados que executam os ataques e partilham os lucros.
- defense-ops№ 215
Cobalt Strike
Plataforma comercial de simulacao de adversarios amplamente usada em operacoes de red team e frequentemente abusada por atacantes para pos-exploracao e comando e controle.
- malware№ 564
IcedID / BokBot
Trojan bancario modular e loader observado pela primeira vez em 2017 que se tornou precursor frequente de implantacoes de ransomware por grupos como Conti e Quantum.
- attacks№ 398
Download drive-by
Ataque em que malware é instalado silenciosamente no dispositivo da vítima simplesmente por visitar um site comprometido ou malicioso.