Loading malware…
GotoHTTP is a cross-platform remote access and remote monitoring tool used by multiple threat actors as post-compromise accessware on Windows, Linux, and server environments including Microsoft IIS infrastructure. It provides remote control capabilities such as persistence, command execution, file transfer, and screen viewing, and has been observed deployed both directly and through in-memory loaders or encrypted payload chains to reduce detection. In intrusion activity, operators have used GotoHTTP to maintain access before and after other objectives such as cryptomining, SEO fraud, and ransomware deployment.
GotoHTTP has been associated with several distinct intrusion clusters. In compromises attributed to Larva-26009 targeting MS-SQL and IIS servers, it was installed alongside other remote administration and tunneling tools to control infected systems, sometimes executed from decrypted shellcode loaders and used in conjunction with web shells, privilege-escalation tooling, internal scanning, and hidden-account persistence. In DragonSpark activity, a Chinese-speaking threat actor used GotoHTTP as one of several open-source tools during opportunistic attacks against exposed web and database servers. In campaigns tracked as UAT-8099 against vulnerable IIS servers in Asia, attackers used web shells and PowerShell or VBScript to download and launch GotoHTTP, then exfiltrated its configuration to obtain the credentials needed for continued remote administration; this activity supported persistent access and follow-on deployment of BadIIS variants used for SEO fraud. In separate ransomware-related intrusions, GotoHTTP was found on victim systems after encryption, indicating likely post-encryption persistence and continued operator access.
The tool is legitimate in origin but is repeatedly abused as an access mechanism in hands-on-keyboard intrusions. Its observed role is primarily persistent remote administration after initial compromise rather than initial delivery itself, and it commonly appears alongside web shells, loaders, tunneling utilities, and other post-exploitation tooling.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
...in this particular attack case, the attacker installed VShell and GotoHTTP to gain control over the [...]
GotoHTTP: a cross-platform remote access tool that implements a wide array of features, such as establishing persistence, file transfer, and screen view.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner.
The threat actor used GotoHTTP to install privilege escalation tools and executed commands as follows: > Net group /domain
The threat actor exploited the MS-SQL server for command execution, which in turn downloaded additional payloads.
a legitimate NVIDIA utility was exploited. The code section of that file was patched to serve as a shellcode loader
While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner.
GotoHTTP ‘yi kalıcılık için kullanıyorlarmış, burayı detect ederiz.
While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner.
GotoHTTP ‘yi kalıcılık için kullanıyorlarmış, burayı detect ederiz.
While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner.
used certutil.Exe to decrypt the web shell downloaded from the internet.
a legitimate NVIDIA utility was exploited. The code section of that file was patched to serve as a shellcode loader
decrypts the shellcode using the DJB2 algorithm, and then executes it in memory.
“Information theft… screenshot theft” / “screen view”
VShell is a backdoor malware developed in the Go programming language... supports protocols such as TCP, HTTP, and UDP for communication with the C&C server
The webshell will take the Base64-encoded AES-encrypted data from the HTTP POST request, then execute the .NET assembly in-memory. These requests are disguised by embedding the encrypted data in HTTP POST parameters.
The compressed file containing XMRig was downloaded through the following command: > Bitsadmin /transfer
When account creation attempts failed, the actor then uploaded and executed the GotoHTTP Remote Monitoring and Management (RMM) tool.
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.