The provided articles describe campaigns involving a loader-based intrusion chain (Gootloader) used to deliver ransomware payloads such as Rhysida.
Overview
The provided articles describe campaigns involving a loader-based intrusion chain (Gootloader) used to deliver ransomware payloads such as Rhysida. While Vanilla Tempest is not explicitly named in the articles, the activity fits loader-first APT-style campaigns that deploy ransomware via deceptive Microsoft Teams ads and similar user-targeted tricks, highlighting evolving delivery techniques and ransomware impact.
Related Threat Clusters
-
Microsoft Disrupts Fox Tempest Malware-Signing Service for Ransomware Gangs
On May 19, 2026, Microsoft disrupted Fox Tempest, a malware-signing-as-a-service (MSaaS) operation that provided over 1,000 fraudulent code-signing certificates to cybercriminals, enabling them to disguise malware as…
33 articles · Updated May 19, 2026 -
Gootloader Malware Resurfaces, Compromises Domain Controllers
Gootloader malware, known for delivering ransomware, has re-emerged after reduced activity, with Huntress reporting three infections since October 27, 2025. Two of these incidents resulted in hands-on-keyboard…
2 articles · Updated November 7, 2025 -
Gootloader Malware Resurfaces, Compromises Domain Controllers
Gootloader malware has re-emerged after a period of reduced activity, with Huntress reporting three infections since October 27, 2025. Two of these incidents resulted in hands-on-keyboard intrusions, leading to domain…
4 articles · Updated November 7, 2025 -
GootLoader Exploits Malformed ZIP Files to Evade Detection
GootLoader malware utilizes malformed ZIP files composed of concatenated archives to bypass security measures. This technique has been linked to ransomware operations, including Vanilla Tempest, and is designed to evade…
2 articles · Updated January 18, 2026 -
Rhysida Ransomware Gang Uses Fake Microsoft Teams Ads for Malware Distribution
The Rhysida ransomware group is exploiting fake advertisements for Microsoft Teams to distribute malware, specifically targeting users searching for the software. This campaign employs malvertising techniques,…
8 articles · Updated November 4, 2025 -
Rhysida Ransomware Gang Uses Fake Microsoft Teams Ads to Infect Users
The Rhysida ransomware gang is exploiting fake ads for Microsoft Teams to distribute malware. Users searching for Microsoft Teams may encounter these deceptive links, which lead to data exfiltration or encryption…
3 articles · Updated November 2, 2025
Recent Intelligence Reports
- Microsoft disrupts malware code — Csoonline · May 20, 2026
- Microsoft shuts down illegal code — Theregister · May 19, 2026
- Cybercrime service disrupted for abusing Microsoft platform to sign malware — Bleepingcomputer · May 19, 2026
- Microsoft disrupts cybercrime service offering malware disguised as legitimate software — Nextgov · May 19, 2026
- Microsoft disrupts cybercrime service that abused software verification systems en masse — Cyberscoop · May 19, 2026
- Gootloader’s malformed ZIP actually works perfectly — Reddit · January 15, 2026
- Gootloader malware back for the attack, serves up ransomware — Theregister · November 7, 2025
- Gootloader malware back for the attack, serves up ransomware — Theregister · November 6, 2025