Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Gootloader, a sophisticated JavaScript-based malware loader, has resurfaced with renewed activity. Used by threat actor Storm-0494, it grants access to Vanilla Tempest, which delivers various ransomware families. Recent infections have led to rapid domain controller compromises. The loader now uses custom WOFF2 fonts with glyph substitution to obfuscate filenames and exploits WordPress comment endpoints for payload delivery. It has shifted to Startup folder persistence and employs extensive obfuscation techniques. Reconnaissance begins quickly after infection, followed by predictable attack patterns including AD enumeration, lateral movement, and potential ransomware preparation. The loader's delivery method and obfuscation techniques have evolved, making it more challenging to detect and analyze.

Gootloader is a JavaScript-based malware loader that has re-emerged with new capabilities and techniques, operated by the threat actor group Storm-0494. It functions as a loader for Vanilla Tempest, a malware family that delivers multiple ransomware variants. The recent campaign features advanced obfuscation using custom WOFF2 fonts with glyph substitution, which complicates static and dynamic analysis by hiding filenames and payload indicators. The loader exploits WordPress comment endpoints to deliver its payload, leveraging SEO poisoning techniques to increase infection rates. Upon successful infection, Gootloader establishes persistence via the Windows Startup folder rather than traditional registry or scheduled task methods, evading some common detection mechanisms. Early post-infection behavior includes rapid reconnaissance activities such as Active Directory enumeration, credential harvesting, and lateral movement within the network. These actions facilitate the compromise of domain controllers, enabling the deployment of ransomware families like Noberus, Quantum Locker, BlackCat, and Alphv. The malware uses extensive obfuscation and anti-analysis techniques, including code encryption and polymorphism, to avoid detection by security tools. The attack chain is characterized by predictable stages, starting from initial infection, reconnaissance, lateral movement, and culminating in ransomware deployment. The use of WordPress comment endpoints as a delivery vector highlights the exploitation of web infrastructure common in many organizations. This evolution in tactics, techniques, and procedures (TTPs) increases the difficulty of detection and response, requiring defenders to adapt their monitoring and mitigation strategies accordingly.

Detailed information about Gootloader Returns: What Goodies Did They Bring?. Get real-time updates, technical details, and mitigation strategies.

Gootloader Returns: What Goodies Did They Bring? - Live Threat Intelligence - Threat Radar | OffSeq.com

Gootloader Returns: What Goodies Did They Bring?

Title	Severity	Type	Source	Date

Threats Tagged 'quantum locker'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'quantum locker'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility