Loading story…
Sophos reported that a GootLoader 3.0 campaign used SEO poisoning to target people in Australia searching Google for information about Bengal cat ownership. Victims were redirected to a compromised website that delivered a malicious ZIP archive containing an obfuscated JavaScript first-stage payload, which then dropped a larger second-stage script linked to GootKit activity.
The malware established persistence with a scheduled task and launched Windows scripting and PowerShell processes. Sophos observed PowerShell making HTTP requests to multiple domains via /xmlrpc.php and sending Base64-encoded host-enumeration data, behavior consistent with GootLoader/GootKit command-and-control. In the investigated case, researchers did not see successful third-stage deployment of GootKit or follow-on tools such as Cobalt Strike or ransomware, but mapped the intrusion to techniques including drive-by compromise, obfuscated files, JavaScript execution, scheduled-task persistence, and exfiltration over web services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In the investigated incident, Sophos did not observe successful deployment of a third-stage payload such as full GootKit, Cobalt Strike, or ransomware. The company identified the malware as GootLoader variant 3.0 and published technical findings on the campaign.
During the same 2024 intrusion, the first-stage script dropped a larger second-stage JavaScript associated with GootKit, created persistence via a scheduled task, and launched Windows scripting and PowerShell processes. Sophos observed PowerShell making HTTP requests to multiple domains via /xmlrpc.php and sending Base64-encoded host enumeration data, consistent with GootLoader/GootKit command-and-control behavior.
In 2024, Sophos X-Ops MDR investigated a GootLoader campaign that used SEO poisoning to lure users searching for information about Bengal cat ownership in Australia to a compromised website. The site delivered a malicious ZIP archive containing an obfuscated JavaScript first-stage payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
sophos.com
Open sourcenews.sophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers operating the **Gootkit** loader compromised legitimate websites and used **SEO poisoning** to lure users searching for legal document templates into downloading malicious ZIP archives. The archives contained JavaScript that, once executed, launched obfuscated PowerShell and began a multi-stage infection chain designed to avoid writing the final payload to disk. Trend Micro reported that the updated intrusion flow used **registry stuffing**, **scheduled-task persistence**, and reflective in-memory loading to reconstruct and run a fileless **Cobalt Strike** beacon. The campaign differed from earlier Gootkit activity by shifting from freeware-themed lures to legal-document themes and by encrypting registry-stored content with a custom text-replacement algorithm instead of Base64; in the observed case, the beacon communicated with `89.238.185.13` before the attack was interrupted.
Aug 15, 2026
Gootloader operators compromised WordPress sites and implanted malicious PHP in theme files, plugin files, the `wp_options` table, and in some cases modified `xmlrpc.php` to selectively serve fake forum-style lure pages and malware only to filtered visitors. The infrastructure used gating based on factors such as geography, Windows user agents, logged-out status, and crawler checks, helping infected sites appear benign to most traffic. Compromised sites were observed contacting domains including `my-game.biz/5.8.18.7` to redraw pages and fetch malicious ZIP archives, while altered `xmlrpc.php` relays forwarded victim metadata to `inerino.co.za` and could return obfuscated PowerShell hidden in GIF responses. On victim systems, users commonly opened ZIP-delivered JScript files that launched via `wscript.exe` or `cscript.exe`, leading to PowerShell execution and in-memory loading of a .NET DLL. That DLL retrieved an obfuscated payload from the Windows Registry, decoded it, and executed follow-on malware including **Cobalt Strike**, **Gootkit**, and **Osiris**, showing Gootloader’s role as an initial access and malware delivery platform. Defenders were advised to watch for suspicious process chains involving `wscript.exe`, `cscript.exe`, `powershell.exe`, and `rundll32.exe` without arguments, and to reduce risk by changing JScript file associations and warning users about document-themed download lures.
Aug 15, 2026
Gootloader malware has re-emerged after a period of inactivity, deploying new techniques to compromise victims through SEO poisoning and malicious JavaScript injected into compromised or attacker-controlled websites. Recent attacks observed by Huntress and other researchers show Gootloader being used to gain initial access to corporate networks, with one incident resulting in a Domain Controller compromise within 17 hours. The loader, operated by the threat actor Storm-0494, provides access to Vanilla Tempest, which then deploys backdoors such as the Supper SOCKS5 and ultimately delivers ransomware, including the Rhysida family. The infection chain leverages obfuscated JavaScript, custom WOFF2 fonts, and XOR-encrypted ZIP archives, with payloads tailored to evade static analysis and exfiltrate sensitive information from active user sessions. The distribution method relies heavily on SEO poisoning, where fake legal document and agreement template sites are promoted in search results, enticing users to download malicious files. Once executed, Gootloader runs PowerShell scripts to enumerate environment variables, running processes, and desktop files, sending this data to hardcoded C2 servers. The operation's infrastructure has been actively targeted by security researchers, leading to a temporary cessation in March 2025, but the campaign has since resumed with new tricks and payloads, including Cobalt Strike and various backdoors. The renewed activity highlights the persistent threat posed by Gootloader and its affiliates, who continue to refine their tactics to evade detection and maximize impact on targeted organizations.
Jun 29, 2026