Supper Malware — Analysis, Campaigns & Threat Activity

Related Threat Clusters

• Gootloader Malware Resurgence Leads to Domain Controller Compromise

  Recent Gootloader attacks have resulted in a Domain Controller compromise within 17 hours, as reported by Huntress. The Gootloader malware, which has been active since 2020, was previously inactive but saw a resurgence…

  2 articles · Updated November 6, 2025
• Rhysida and Interlock Ransomware Groups Exploit Shared Malware Ecosystem

  Recent analysis reveals that Rhysida and Interlock ransomware groups are interconnected through a shared ecosystem of malware tools, including the Supper backdoor. Both groups utilize initial access brokers and a…

  3 articles · Updated June 16, 2026
• Enhanced pkr_mtsi Malware Loader Distributes Multiple Payloads

  The pkr_mtsi malware loader has been upgraded to incorporate advanced stealth techniques, including hashed API resolution and improved obfuscation. Initially observed in April 2025, it is utilized for deploying various…

  2 articles · Updated January 8, 2026
• Gootloader Malware Resurfaces, Compromises Domain Controllers

  Gootloader malware, known for delivering ransomware, has re-emerged after reduced activity, with Huntress reporting three infections since October 27, 2025. Two of these incidents resulted in hands-on-keyboard…

  2 articles · Updated November 7, 2025
• Gootloader Malware Resurfaces, Compromises Domain Controllers

  Gootloader malware has re-emerged after a period of reduced activity, with Huntress reporting three infections since October 27, 2025. Two of these incidents resulted in hands-on-keyboard intrusions, leading to domain…

  4 articles · Updated November 7, 2025

Recent Intelligence Reports

• Interlock and Rhysida Ransomware Operations Share Supper Backdoor and Malware Codebase — Cybersecuritynews · June 16, 2026
• Rhysida and Interlock Ransomware Groups Linked to Initial Access Brokers and Crypter Ecosystem — Gbhackers · June 16, 2026
• Increased stealth integrated into flexible pkr_mtsi malware loader — Scworld · January 8, 2026
• Versatile Malware Loader pkr_mtsi Delivers Diverse Payloads — Infosecurity-Magazine · January 7, 2026
• Gootloader malware back for the attack, serves up ransomware — Theregister · November 6, 2025
• New Gootloader attacks drop Supper SOCKS5 backdoor — Scmagazine · November 6, 2025

Related Entities