Full Report
Gootloader returns with new obfuscation techniques, including custom WOFF2 fonts and updated persistence mechanisms, while continuing its partnership with Vanilla Tempest for ransomware deployment. Dive in and discover what Huntress is seeing.
Analysis Summary
# Tool/Technique: Gootloader (2025 Variant)
## Overview
Gootloader is a sophisticated JavaScript-based malware loader used primarily for initial access. It leverages Search Engine Optimization (SEO) poisoning to lure users to compromised websites (often WordPress) hosting malicious documents. Once executed, it facilitates the delivery of secondary payloads, most notably serving as a precursor for ransomware deployments by the threat actor Vanilla Tempest.
## Technical Details
- **Type:** Malware family (Loader)
- **Platform:** Windows
- **Capabilities:** SEO poisoning, web-based obfuscation, XOR-encrypted payload delivery, persistence, and reconnaissance.
- **First Seen:** Active since 2020 (New variant observed late October 2025).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise]
- [T1566.003 - Phishing: Spearphishing Link (via SEO Poisoning)]
- **[TA0002 - Execution]**
- [T1059.007 - Command and Scripting Interpreter: JavaScript]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1027.013 - Data Obfuscation: Steganography/Custom Decoding (WOFF2 Glyph Substitution)]
- [T1564.004 - Hide Artifacts: NTFS File Attributes (8.3 Short Filenames)]
- **[TA0008 - Lateral Movement]**
- [T1021.006 - Remote Services: Windows Remote Management (WinRM)]
## Functionality
### Core Capabilities
- **SEO Poisoning:** Targets specific long-tail search queries (e.g., legal or utility templates) to appear as the top result.
- **WordPress Exploitation:** Abuses the `/wp-comments-post.php` endpoint to deliver XOR-encrypted ZIP payloads.
- **Dynamic Decryption:** Uses unique XOR keys for each payload, often derived from the filename itself, hardcoded in the landing page source.
### Advanced Features
- **WOFF2 Obfuscation:** Uses custom Web Open Font Format (WOFF2) files with mapped glyph substitution. This makes filenames appear as garbled characters in the source code/copy-paste buffer while appearing as legitimate text to the user in the browser.
- **Persistence Shift:** Recent variants have transitioned from Scheduled Tasks to utilizing the Windows **Startup folder** for persistence.
- **8.3 Filename Obfuscation:** Utilizes legacy Windows 8.3 short filenames (e.g., `DOCUME~1.JS`) to evade detection patterns looking for long, suspicious filenames.
## Indicators of Compromise
- **File Names:** Common patterns include document-themed names like `[State]_Utility_Easement_Guide_2023.zip` or `[State]_HOA_Contracts.js`.
- **Network Indicators:**
- Compromised WordPress sites acting as delivery nodes.
- POST requests to `[domain]/wp-comments-post[.]php` with `comment_post_ID` parameters.
- **Behavioral Indicators:**
- WScript/CScript executing JavaScript files from the `AppData` or `Startup` folders.
- Rapid transition (within 20-60 minutes) to AD enumeration (Kerberoasting/SPN scanning).
- Use of **Supper SOCKS5 Backdoor** for C2 communication.
## Associated Threat Actors
- **Storm-0494:** Primary actor identified using Gootloader for initial access.
- **Vanilla Tempest (formerly DEV-0832):** Affiliate group that receives access from Storm-0494 to deploy ransomware (Rhysida, BlackCat, Zeppelin, Quantum Locker).
## Detection Methods
- **Behavioral Detection:** Monitor for `wscript.exe` or `cscript.exe` launching files with 8.3 naming conventions or executing scripts from the `\Microsoft\Windows\Start Menu\Programs\Startup\` directory.
- **Network Monitoring:** Alert on unusual POST traffic to WordPress comment endpoints that return ZIP or JS file headers.
- **Endpoint Inspection:** Inspect WOFF2 files on suspected landing pages for non-standard glyph mapping tables.
## Mitigation Strategies
- **User Training:** Educate users on the risks of downloading "templates" or "guides" from unfamiliar websites, even if they appear first in search results.
- **Script Blocklisting:** Disable `WScript` and `CScript` via Group Policy if not required for business operations, or associate `.js` files with Notepad by default.
- **Directory Restrictions:** Implement AppLocker or Software Restriction Policies (SRP) to prevent script execution from the `AppData` and `Temp` directories.
## Related Tools/Techniques
- **Supper SOCKS5 Backdoor:** The preferred post-exploitation tool for Vanilla Tempest, featuring API hammering and LZMA compression.
- **SEO Poisoning:** A common delivery tactic also seen in SocGholish (FakeUpdates) infections.