Loading malware…
Gootloader is a Windows-focused JavaScript malware delivery framework and initial-access malware operation commonly associated with SEO poisoning and compromised WordPress infrastructure. It is widely characterized as Malware-as-a-Service or Initial Access as a Service because it is used to establish a foothold on victim systems and then deliver follow-on payloads for other operators. Observed downstream payloads have included Cobalt Strike, IcedID, GootKit, Kronos, REvil, BlueCrab, and SystemBC, and Gootloader intrusions have repeatedly preceded broader post-compromise activity including credential theft, lateral movement, and ransomware deployment by follow-on actors.
The infection chain typically begins when a victim searches for business, legal, contract, or agreement-related terms and clicks a poisoned search result that leads to a compromised website masquerading as a forum or discussion page. The lure commonly delivers a ZIP archive containing a heavily obfuscated JavaScript file. After execution through Windows Script Host, Gootloader commonly launches additional JavaScript and PowerShell stages, performs host profiling, and contacts attacker-controlled or compromised web infrastructure for further instructions or payload retrieval. Multiple campaigns have used geofencing, referrer checks, repeat-visitor suppression, and Active Directory domain checks to selectively target enterprise victims.
Gootloader is notable for its layered obfuscation and largely fileless execution model. Observed variants decode additional stages at runtime, store encoded payload components in the Windows Registry, and use PowerShell or .NET loaders to reconstruct and execute later stages in memory. Persistence has frequently been established through scheduled tasks, and some variants have also used autorun-style mechanisms. Several campaigns showed immediate host fingerprinting and exfiltration of system metadata, including process, environment, desktop, and drive information, allowing operators to decide whether to deploy additional malware.
For defense evasion and execution, Gootloader has used process hollowing to inject payloads into legitimate Windows processes, including ImagingDevices.exe and other benign executables. The framework has been observed using registry-resident staging, reflective loading, and multi-layer JavaScript transformations that complicate static analysis and IOC extraction. Operationally, Gootloader campaigns have targeted organizations across finance, healthcare, pharmaceutical, energy, automotive, military, government, and other enterprise sectors, with activity documented across North America, Europe, Asia, and other regions.
Gootloader is best understood as a flexible access-and-delivery platform rather than a single-purpose payload. Its core role is to gain initial execution on Windows systems, maintain persistence, profile the victim environment, and enable selective deployment of higher-value malware for espionage, credential access, lateral movement, or ransomware operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
During the month of December 2022, the Cybereason Incident Response (IR) team investigated an incident which involved new deployment methods of GootLoader... GootLoader targets companies in English-speaking countries... targeted attacks have been more prominent against healthcare and finance organizations.
While the Lorem Ipsum and Gootloader chains are technically distinct, the shared reliance on compromised WordPress infrastructure suggests either common access broker sources, shared compromise tooling, or operator-level coordination between the two pipelines.
While the Lorem Ipsum and Gootloader chains are technically distinct, the shared reliance on compromised WordPress infrastructure suggests either common access broker sources, shared compromise tooling, or operator-level coordination between the two pipelines.
Rhysida actors, operating under the Vanilla Tempest cluster, have used Gootloader-based access that hands off to Supper before ransomware is deployed.
During the attack, Vanilla Tempest gained network access through the Storm-0494 threat actor, who infected the victim's systems with the Gootloader malware downloader.
GootLoader, a JavaScript-based malware loader, returned with new obfuscation techniques. It uses custom WOFF2 fonts and exploits WordPress comment sections to deliver malicious payloads.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
In some cases, we have observed the scheduled task is created as a persistence mechanism to decode the registry values
powershell_persistence: this PowerShell script creates a scheduled task to execute the loader PowerShell script (powershell_loader) at boot time.
This list is used by GootLoader to rearrange the code into the right order and then later on execute it using the eval function.
One of the malicious PHP scripts the attackers add to the website is a simple PHP command shell... The attackers perform an HTTPS POST request with a base64-encoded string of commands, which the WordPress installation will then execute
The core component of Gootloader is a small js loader (2.8 KB) that acts as the first-stage of the infection chain.
In some cases, we have observed the scheduled task is created as a persistence mechanism to decode the registry values
powershell_persistence: this PowerShell script creates a scheduled task to execute the loader PowerShell script (powershell_loader) at boot time.
The first main encoded payload is written to the registry key under HKEY_CURRENT_USER\SOFTWARE\Microsoft\username\ via Wscript process using RegWrite Method.
Gootloader maintains persistence on a blog, by adding PHP code to various files, typically in the themes directory, but have also seen it in the plugins directory. | Additionally, stored in the “wp_options” table, is base64 encoded PHP code is stored, this combination allows them to remotely run PHP code.
In some cases, we have observed the scheduled task is created as a persistence mechanism to decode the registry values
powershell_persistence: this PowerShell script creates a scheduled task to execute the loader PowerShell script (powershell_loader) at boot time.
The loader is composed of three highly obfuscated layers that contain encoded URLs.
rule Gootloader_JavaScript_infector ... strings: $a1 ... $a2 ... $a3 ... $a4 ...
These 2 PowerShell scripts are fileless... The .NET loader is fileless and thus has no filename... This payload is designed to filelessly, and with boot-persistence, instantiate a Cobalt Strike beacon.
Gootloader is using a process hollowing technique to inject IcedID loader into PowerShell processes.
The script checks if the infected host is a part of the Active Directory domain by using the environment variable %USERDNSDOMAIN%
This script performs some basic discovery of information about the host using built-in PowerShell Cmdlets and WMI queries.
Upon the successful communication with the C2 channel, Gootloader serves the second-stage payloads to the infected host from one of the infected websites in less than 2 minutes from the execution of the JavaScript file.
The gathered information then is base64-encoded and compressed to be sent out over POST requests to WordPress domains with the tags in the Cookie field over HTTP/HTTPs.
255 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
111 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as a loader / initial access malware associated with access brokerage used to help obtain initial access for INC Ransom operations.
Malware/loader used in SEO-poisoning campaigns via compromised WordPress sites and fake forum pages offering legal or business document templates; used to gain initial footholds that are then sold to ransomware operators.
Gootloader2
A loader used for initial access in Rhysida intrusions, handing off to Supper before ransomware deployment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.