Gootloader Malware Resurfaces, Compromises Domain Controllers

Huntress

Gootloader Malware Resurfaces, Compromises Domain Controllers

First seen 2 Dec 2025, 18:33 UTC • •39.3

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Gootloader malware has re-emerged after a period of reduced activity, with Huntress reporting three infections since October 27, 2025. Two of these incidents resulted in hands-on-keyboard intrusions, leading to domain controller compromises within 17 hours. The malware, which uses obfuscated JavaScript, is typically delivered via compromised websites and is associated with the threat actor Storm-0494.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 226d ago How this analysis works

More articles in this cluster (4)

Threat Graph

20 entities, 45 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

Vanilla Tempest
Rhysida
Vice Society

Technique (6)

Active Directory enumeration
Kerberoasting
Malware
Ransomware
Windows Remote Management
Windows Remote Management (WinRM)

Malware (5)

Gootloader
OysterLoader
Supper
Supper Backdoor
Supper Socks5 Backdoor

Affected Platform (2)

Windows
WordPress

Tool (4)

Impacket
PowerShell
TextShell
WinRM

Relationships

Vanilla Tempest uses Gootloader
Vanilla Tempest uses OysterLoader
Vanilla Tempest uses Supper
Vanilla Tempest uses Supper Backdoor
Vanilla Tempest uses Supper Socks5 Backdoor
Rhysida uses Gootloader
Rhysida uses OysterLoader
Rhysida uses Supper
Rhysida uses Supper Backdoor
Rhysida uses Supper Socks5 Backdoor
Vice Society uses Gootloader
Vice Society uses OysterLoader
Vice Society uses Supper
Vice Society uses Supper Backdoor
Vice Society uses Supper Socks5 Backdoor
Vanilla Tempest uses Impacket
Vanilla Tempest uses PowerShell
Vanilla Tempest uses TextShell
Vanilla Tempest uses WinRM
Rhysida uses Impacket
Rhysida uses PowerShell
Rhysida uses TextShell
Rhysida uses WinRM
Vice Society uses Impacket
Vice Society uses PowerShell
Vice Society uses TextShell
Vice Society uses WinRM
Vanilla Tempest uses Active Directory enumeration
Vanilla Tempest uses Kerberoasting
Vanilla Tempest uses Malware
Vanilla Tempest uses Ransomware
Vanilla Tempest uses Windows Remote Management
Rhysida uses Active Directory enumeration
Rhysida uses Kerberoasting
Rhysida uses Malware
Rhysida uses Ransomware
Rhysida uses Windows Remote Management
Vice Society uses Active Directory enumeration
Vice Society uses Kerberoasting
Vice Society uses Malware
Vice Society uses Ransomware
Vice Society uses Windows Remote Management
Vanilla Tempest related to Windows Remote Management (WinRM)
Vanilla Tempest related to Windows
Vanilla Tempest related to WordPress

Following this threat?

Track Rhysida, Vanilla Tempest and Gootloader in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Anne Arundel County Faces Second Cyberattack in 18 Months Anne Arundel County, Maryland, confirmed a data breach on August 28, 2026, where hackers accessed and copied files from a limited number of government systems. The Rhysida ransomware gang claimed responsibility, threatening to leak 2.6 terabytes of documents unless a $2 million ransom is paid. County officials stated…

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…