GateKeeper
GateKeeper is a .NET payload associated with the financially motivated threat actor KongTuke, also tracked as Woodgnat. The provided reporting describes it as an encrypted .NET payload with layered string encryption, extensive anti-analysis logic, and victim-fingerprinting functionality. In the observed KongTuke infection chain, GateKeeper appeared in the non-domain-host branch after PowerShell-based staging and environment checks. Its Main() routine was described as building a fingerprint of the victim machine by performing a gauntlet of anti-analysis checks, and the broader chain included checks for analysis tools and virtualized environments as well as host profiling to determine payload selection. The content links GateKeeper to KongTuke operations that used social-engineering lures such as CrashFix/ClickFix-style techniques and selective payloading, with GateKeeper used as part of a more obfuscated path intended to withhold follow-on payloads from sandboxes and other analysis environments. No standalone IOCs specific to GateKeeper were provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GateKeeper : A .NET payload featuring layered encryption and extensive anti-analysis and victim-fingerprinting logic.
KongTuke is known to use multiple other tools, such as ... the encrypted GateKeeper .NET payload...
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Stealth
2 techniques
Stealth
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An encrypted .NET payload used by KongTuke as part of its toolset.
A .NET payload used in Woodgnat attack chains that employs layered encryption, anti-analysis measures, and victim fingerprinting.
.NET loader/payload component in the KongTuke chain featuring layered string encryption (AES-256-CBC + XOR), extensive anti-analysis/VM/sandbox fingerprinting, and C2 decisioning based on a numeric fingerprint score to withhold real payloads from researchers/sandboxes.
.NET loader/payload component in the KongTuke chain featuring layered string encryption (AES-256-CBC + XOR), extensive anti-analysis and environment fingerprinting to gate payload delivery, and C2 logic that can withhold real payloads in suspected analysis environments (observed returning 'TEST PAYLOAD!!!!' in testing).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.