Gootloader Malware Resurfaces, Compromises Domain Controllers
Article Content
Browse articles 
Gootloader malware, known for delivering ransomware, has re-emerged after reduced activity, with Huntress reporting three infections since October 27, 2025. Two of these incidents resulted in hands-on-keyboard intrusions and domain controller compromises within 17 hours. The malware is attributed to the threat actor tracked as Storm-0494.
Ask AI about this cluster
Answers cite the sources they use
Updated 226d ago How this analysis works
More articles in this cluster (2)
Following this threat?
Track Rhysida, Vanilla Tempest and Gootloader in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Anne Arundel County Faces Second Cyberattack in 18 Months Anne Arundel County, Maryland, confirmed a data breach on August 28, 2026, where hackers accessed and copied files from a limited number of government systems. The Rhysida ransomware gang claimed responsibility, threatening to leak 2.6 terabytes of documents unless a $2 million ransom is paid. County officials stated… 
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…