Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

GCP Compute Engine Security

JVN Japan

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Check Point Research

Kaspersky Security Blog

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Gootloader, a sophisticated JavaScript-based malware loader, has resurfaced with renewed activity. Used by threat actor Storm-0494, it grants access to Vanilla Tempest, which delivers various ransomware families. Recent infections have led to rapid domain controller compromises. The loader now uses custom WOFF2 fonts with glyph substitution to obfuscate filenames and exploits WordPress comment endpoints for payload delivery. It has shifted to Startup folder persistence and employs extensive obfuscation techniques. Reconnaissance begins quickly after infection, followed by predictable attack patterns including AD enumeration, lateral movement, and potential ransomware preparation. The loader's delivery method and obfuscation techniques have evolved, making it more challenging to detect and analyze.

Gootloader is a JavaScript-based malware loader that has re-emerged with new capabilities and techniques, operated by the threat actor group Storm-0494. It functions as a loader for Vanilla Tempest, a malware family that delivers multiple ransomware variants. The recent campaign features advanced obfuscation using custom WOFF2 fonts with glyph substitution, which complicates static and dynamic analysis by hiding filenames and payload indicators. The loader exploits WordPress comment endpoints to deliver its payload, leveraging SEO poisoning techniques to increase infection rates. Upon successful infection, Gootloader establishes persistence via the Windows Startup folder rather than traditional registry or scheduled task methods, evading some common detection mechanisms. Early post-infection behavior includes rapid reconnaissance activities such as Active Directory enumeration, credential harvesting, and lateral movement within the network. These actions facilitate the compromise of domain controllers, enabling the deployment of ransomware families like Noberus, Quantum Locker, BlackCat, and Alphv. The malware uses extensive obfuscation and anti-analysis techniques, including code encryption and polymorphism, to avoid detection by security tools. The attack chain is characterized by predictable stages, starting from initial infection, reconnaissance, lateral movement, and culminating in ransomware deployment. The use of WordPress comment endpoints as a delivery vector highlights the exploitation of web infrastructure common in many organizations. This evolution in tactics, techniques, and procedures (TTPs) increases the difficulty of detection and response, requiring defenders to adapt their monitoring and mitigation strategies accordingly.

Detailed information about Gootloader Returns: What Goodies Did They Bring?. Get real-time updates, technical details, and mitigation strategies.

Gootloader Returns: What Goodies Did They Bring? - Live Threat Intelligence - Threat Radar | OffSeq.com

Gootloader Returns: What Goodies Did They Bring?

Threats Tagged 'gootloader - s1138'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'gootloader - s1138'

Lead Pen Test Professional