Gootloader Returns: What Goodies Did They Bring?

Gootloader, a sophisticated JavaScript-based malware loader, has resurfaced with renewed activity. Used by threat actor Storm-0494, it grants access to Vanilla Tempest, which delivers various ransomware families. Recent infections have led to rapid domain controller compromises. The loader now uses custom WOFF2 fonts with glyph substitution to obfuscate filenames and exploits WordPress comment endpoints for payload delivery. It has shifted to Startup folder persistence and employs extensive obfuscation techniques. Reconnaissance begins quickly after infection, followed by predictable attack patterns including AD enumeration, lateral movement, and potential ransomware preparation. The loader's delivery method and obfuscation techniques have evolved, making it more challenging to detect and analyze.

• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257ExploitedVulnerability2026-10-20
• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareAnalysis2026-10-23
• SEO Poisoning Campaign Delivers New Armorsteal MalwareMalware2026-10-22
• Authorities disrupt nearly 11,000 cybercrime networks in AfricaNews2026-10-22