Related Threat Clusters
-
Gootloader Malware Resurgence Leads to Domain Controller Compromise
Recent Gootloader attacks have resulted in a Domain Controller compromise within 17 hours, as reported by Huntress. The Gootloader malware, which has been active since 2020, was previously inactive but saw a resurgence…
2 articles · Updated November 6, 2025 -
Rhysida and Interlock Ransomware Groups Exploit Shared Malware Ecosystem
Recent analysis reveals that Rhysida and Interlock ransomware groups are interconnected through a shared ecosystem of malware tools, including the Supper backdoor. Both groups utilize initial access brokers and a…
3 articles · Updated June 16, 2026 -
Enhanced pkr_mtsi Malware Loader Distributes Multiple Payloads
The pkr_mtsi malware loader has been upgraded to incorporate advanced stealth techniques, including hashed API resolution and improved obfuscation. Initially observed in April 2025, it is utilized for deploying various…
2 articles · Updated January 8, 2026 -
Gootloader Malware Resurfaces, Compromises Domain Controllers
Gootloader malware, known for delivering ransomware, has re-emerged after reduced activity, with Huntress reporting three infections since October 27, 2025. Two of these incidents resulted in hands-on-keyboard…
2 articles · Updated November 7, 2025 -
Gootloader Malware Resurfaces, Compromises Domain Controllers
Gootloader malware has re-emerged after a period of reduced activity, with Huntress reporting three infections since October 27, 2025. Two of these incidents resulted in hands-on-keyboard intrusions, leading to domain…
4 articles · Updated November 7, 2025
Recent Intelligence Reports
- Interlock and Rhysida Ransomware Operations Share Supper Backdoor and Malware Codebase — Cybersecuritynews · June 16, 2026
- Rhysida and Interlock Ransomware Groups Linked to Initial Access Brokers and Crypter Ecosystem — Gbhackers · June 16, 2026
- Increased stealth integrated into flexible pkr_mtsi malware loader — Scworld · January 8, 2026
- Versatile Malware Loader pkr_mtsi Delivers Diverse Payloads — Infosecurity-Magazine · January 7, 2026
- Gootloader malware back for the attack, serves up ransomware — Theregister · November 6, 2025
- New Gootloader attacks drop Supper SOCKS5 backdoor — Scmagazine · November 6, 2025