Gootloader Malware Resurfaces, Compromises Domain Controllers

First seen 23 Nov 2025, 03:35 UTC • Theregister

•40

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Gootloader malware, known for delivering ransomware, has re-emerged after reduced activity, with Huntress reporting three infections since October 27, 2025. Two of these incidents resulted in hands-on-keyboard intrusions and domain controller compromises within 17 hours. The malware is attributed to the threat actor tracked as Storm-0494.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

14 entities, 29 inferred relationships (STIX 2.1).

Threat Actor (3)

Vanilla Tempest
Rhysida
Vice Society

Technique (2)

Ransomware
Windows Remote Management

Malware (5)

Gootloader
OysterLoader
Supper
Supper Backdoor
Supper Socks5 Backdoor

Affected Platform (2)

Windows
WordPress

Tool (2)

Impacket
TextShell

Relationships

Vanilla Tempest uses Gootloader
Vanilla Tempest uses OysterLoader
Vanilla Tempest uses Supper
Vanilla Tempest uses Supper Backdoor
Vanilla Tempest uses Supper Socks5 Backdoor
Rhysida uses Gootloader
Rhysida uses OysterLoader
Rhysida uses Supper
Rhysida uses Supper Backdoor
Rhysida uses Supper Socks5 Backdoor
Vice Society uses Gootloader
Vice Society uses OysterLoader
Vice Society uses Supper
Vice Society uses Supper Backdoor
Vice Society uses Supper Socks5 Backdoor
Vanilla Tempest uses Impacket
Vanilla Tempest uses TextShell
Rhysida uses Impacket
Rhysida uses TextShell
Vice Society uses Impacket
Vice Society uses TextShell
Vanilla Tempest uses Ransomware
Vanilla Tempest uses Windows Remote Management
Rhysida uses Ransomware
Rhysida uses Windows Remote Management
Vice Society uses Ransomware
Vice Society uses Windows Remote Management
Vanilla Tempest related to Windows
Vanilla Tempest related to WordPress

Continue Reading

Microsoft Disrupts Fox Tempest Malware-Signing Service for Ransomware Gangs Node.js Exploited in Ransomware Attacks Using EtherHiding Technique New Mistic Backdoor Linked to Ransomware Access Broker Activity Cookeville Medical Center Data Breach Affects Over 337,000 Patients Ransomware Attack on Berlin Senate: Data Exfiltration and Phishing Vector Ransomware Fuels Surge in Global Cyberattacks

Gootloader Malware Resurfaces, Compromises Domain Controllers

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading