GootLoader Malware: Detection and Defence Guide

GootLoader turns an ordinary search for a contract or agreement template into a hands-on-keyboard intrusion, often within the hour, because the user downloads and runs a JavaScript file they believe is a document. MITRE ATT&CK tracks it as software S1138, a JavaScript-based infection framework in use since at least 2020 that operates as "initial access as a service" and has delivered Gootkit, Cobalt Strike, REvil and other payloads. This guide is for SOC analysts, detection engineers, endpoint administrators and incident responders who need to stop the chain early and recognise it quickly when it gets through. It goes deeper than the Malvertising and SEO Poisoning Guide, which covers the lure class in general, and it describes attacker behaviour at the level defenders need, with no tooling or reproduction steps.

Key takeaways

The lure is a search result, not an email. Victims search for narrow legal and business phrases, land on a compromised legitimate site showing a fake forum thread, and download a ZIP named after their own query.
The JavaScript file is the choke point. In the documented chains it is the only stage written to disk; blocking script hosts from running downloaded scripts, or making scripts open in a text editor, breaks the attack before any payload arrives.
Hand-off to ransomware crews is fast. The DFIR Report saw Active Directory reconnaissance about 15 minutes after execution; Huntress reported reconnaissance within about 20 minutes and a domain controller compromised about 17 hours later in the November 2025 wave.
Payloads live in the registry and in memory. Hunt for encoded data in unusual HKCU values, PowerShell that reads the registry at logon, and persistence through scheduled tasks or Startup folder shortcuts.
The operators keep changing the surface. Custom web fonts that hide filenames from page-source scanning and ZIPs that extract differently in different tools mean behavioural detection outlasts any indicator list.

What GootLoader is and who runs it

GootLoader grew out of the Gootkit banking trojan ecosystem and became a delivery platform in its own right. ATT&CK describes it as targeting entities in multiple sectors worldwide, including financial, military, automotive, pharmaceutical and energy, and links its initial access to T1608.006 SEO Poisoning. Sophos reported in 2021 that the operators maintained roughly 400 hacked legitimate sites at any one time to host lures.

Two roles matter to defenders, and the names below are those used in Huntress's November 2025 research:

Role	Tracked name	What it does	Defensive meaning
Loader operator	Storm-0494	Runs the SEO poisoning infrastructure, the JavaScript first stage and early reconnaissance	Initial access is a commodity service: one infection can be resold
Follow-on intrusion set	Vanilla Tempest	Takes over access and has deployed ransomware families including Rhysida, BlackCat, Zeppelin and Quantum Locker	Treat any confirmed execution as a pre-ransomware incident, not a commodity malware clean-up
Historic payloads	Gootkit, Kronos, REvil, Cobalt Strike (Sophos, ATT&CK)	Banking theft, remote control and ransomware	The final payload varies; the delivery chain is the stable target

The access-broker model is covered in the Initial Access Brokers Guide, and the loader category as a whole in the Malware Loaders and Droppers Guide.

How the infection chain works

The stages below come from The DFIR Report (2022), Sophos (2021) and Huntress (2025). They are described so defenders can place controls and detections; they are not a recipe.

Stage	What happens	ATT&CK	Best control point
1. Infrastructure	Legitimate sites, often WordPress, are compromised and injected with script that serves lure pages	T1584.001 Domains, T1584.006 Web Services	Web filtering by domain age and category; site owners patch the CMS
2. Lure	Pages rank for long-tail queries such as a named plea agreement or HOA meeting guide; a fake message board repeats the query and offers a "direct download"	T1608.006 SEO Poisoning, T1204.001 Malicious Link	User awareness for document downloads; browser and DNS protection
3. Victim filtering	Server-side code checks User-Agent language, IP geolocation and the search referrer; others see a benign page	T1614.001 System Language Discovery, T1614 System Location Discovery	Explains why sandboxes and analysts often see nothing
4. Download	A ZIP named after the search contains a .js file; in 2025 the archive was served XOR-encrypted through the WordPress comment endpoint	T1204.002 Malicious File	Mark of the Web, extension visibility, archive inspection
5. Execution	The user double-clicks the script, which Windows runs through the Windows Script Host by default	T1059.007 JavaScript	ASR rules, script host restriction, file association change
6. Staging	The script fetches further code from hardcoded domains and stores encoded payloads in HKCU registry values	T1105 Ingress Tool Transfer, T1027, T1140	Registry and network telemetry
7. Persistence	A scheduled task at logon (2022) or Startup folder shortcuts using 8.3 short names (2025) relaunch PowerShell	T1053.005 Scheduled Task, T1547.001 Registry Run Keys / Startup Folder	Persistence monitoring
8. In-memory loading	PowerShell loads a .NET or Delphi loader that runs the payload in memory, including process hollowing of a benign signed binary	T1059.001 PowerShell, T1055.012 Process Hollowing	AMSI, script block logging, EDR memory detections
9. Hand-off	Domain reconnaissance, credential theft and lateral movement by the follow-on actor	T1069.002 Domain Groups, T1003.003 NTDS, T1021.001 RDP	Identity threat detection and tiered admin

Sophos stressed that the chain "isn't completely fileless": the .js file touches disk and the registry stores the payload, so behavioural detection still has something to catch. The ATT&CK entry also records time-based checks (T1497.003) with sleeps of more than 22 seconds between stages, which can defeat short sandbox runs.

How the 2025 wave changed the picture

After a pause, GootLoader activity returned in late October 2025. Huntress reported three infections from 27 October, two of which became hands-on-keyboard intrusions. The changes that matter for defence:

Font-based filename hiding: lure pages embed a custom WOFF2 web font that swaps glyph outlines, so text that looks like gibberish in the HTML source renders as a believable filename. Keyword scanning of page source, used by some web proxies and threat hunters, misses it.
Archive behaviour that differs by tool: Huntress reported that 7-Zip extracted a file disguised as .txt while the built-in Windows extraction produced an executable .js file. Analysts triaging with a different tool from the victim's can wrongly conclude the file is harmless.
Script camouflage: the JavaScript masquerades as the jQuery library and rebuilds a PowerShell script that collects environment variables, window titles, desktop items and drive information, then beacons to ten command-and-control domains every 20 seconds.
Persistence moved to the Startup folder: shortcuts with 8.3 short names and keyboard hotkeys replaced the logon scheduled task seen in 2022.
Follow-on tooling: the follow-on actor dropped a SOCKS5 backdoor that Huntress calls Supper, created a Domain Admin account, ran DCSync in one case and enumerated Volume Shadow Copies, consistent with preparation for ransomware.

The lesson is that indicator lists (domains, filenames, hashes) age in weeks, while the structural facts (a script from a downloaded archive, PowerShell reading HKCU at logon, rapid AD enumeration from a workstation) hold across years.

Prevention: break the chain at the script

Every documented GootLoader chain depends on a user being able to run a downloaded .js file with the Windows Script Host. Controls at that one step give the best return; the rest add depth.

Control	What to configure	Stops	Trade-off
ASR rule: scripts launching downloaded content	Microsoft Defender for Endpoint rule "Block JavaScript or VBScript from launching downloaded executable content", GUID d3e037e1-3eb8-44c8-a917-57927947596d, Audit then Block	Stage 5 and 6 downloads; The DFIR Report said this rule would have stopped the chain at the first step	Requires Defender Antivirus and AMSI; not supported on Windows Server 2016 or 2012 R2
ASR rule: obfuscated scripts	"Block execution of potentially obfuscated scripts", GUID 5beb7efe-fd9a-4556-801d-275e5ffc04cc	Obfuscated first stage and PowerShell stagers	Needs cloud-delivered protection; audit first, some admin scripts trip it
ASR rule: untrusted executables	"Block executable files from running unless they meet a prevalence, age, or trusted list criterion", GUID 01443614-cd74-433a-b99e-2ecdc07bfc25	Unknown dropped executables later in the chain	Needs cloud-delivered protection; produces user notifications but no EDR alerts
Script file association	Set .js, .jse, .vbs and .vbe to open in a text editor by policy for users who never need to run them	Double-click execution at stage 5	Low cost; scripts run deliberately by IT must call the host explicitly
Application control	Block or restrict wscript.exe and cscript.exe for standard users with WDAC or AppLocker rules	All script-host execution, including variants other ASR rules miss	Inventory legacy logon scripts first
PowerShell constraints	Constrained Language Mode through application control, script block logging and AMSI kept enabled	Stages 7 and 8	See the PowerShell Security Guide
Show file extensions	Turn off "Hide extensions for known file types" by policy, as Sophos advises	Recognition of a .js masquerading as a document	Helps users; never a control on its own
Web and DNS filtering	Block newly registered and uncategorised domains, and apply reputation filtering to downloads of archives	Stage 2 and 6 infrastructure	Compromised legitimate sites have good reputation, so expect gaps

The rollout steps for ASR are in How to Deploy Attack Surface Reduction Rules. The choice between allowlisting and detection-led approaches is discussed in Application Allowlisting vs EDR.

Choosing the right mix

Small organisations on Microsoft 365 Business Premium or similar: the ASR rule for downloaded content plus the file association change covers most of the risk with little effort.
Large estates with legacy scripting: run the ASR rules in audit for two to four weeks, review the audited events per device group, and move to block ring by ring. Application control on the script hosts follows once logon scripts are inventoried.
Legal, real estate, finance and professional services teams: these users search for agreement and form templates daily. Prioritise them in the first enforcement ring and in targeted awareness.
Non-Microsoft EDR: look for the equivalent controls: blocking script interpreters launched from archive or download paths, and alerting on script hosts spawning PowerShell.

Detection and hunting

Detections should follow the chain so that a miss at one stage is caught at the next. The table lists the telemetry and the behaviour to look for, drawn from the three primary reports.

Stage	Telemetry	Behaviour to alert or hunt on
Download and execution	Process creation (Sysmon event 1 or EDR), file creation (Sysmon 11)	wscript.exe or cscript.exe running a .js from a user Downloads, Temp or archive extraction path, especially with a filename that reads like a document title
Script host child processes	Process tree	wscript.exe spawning powershell.exe or cmd.exe; ASR ActionTypes AsrScriptExecutableDownloadAudited or AsrScriptExecutableDownloadBlocked in Defender advanced hunting
Registry staging	Registry value set (Sysmon 13)	Large encoded values written by a script host or PowerShell under HKCU\Software; The DFIR Report saw values named Username and Username0 under HKCU\SOFTWARE\Microsoft\Phone
Persistence	Event 4698 (scheduled task created), file creation in the Startup folder	Logon-triggered task named after the user that launches hidden PowerShell; new .lnk files with 8.3 short names or hotkeys in a user Startup folder
PowerShell loading	Event 4104 script block logging, 4103 module logging, AMSI	PowerShell that reads a registry value and loads an assembly into memory; long encoded command lines
Defence tampering	Defender operational log, process creation	Deletion of Windows Defender scheduled tasks; changes that disable real-time or behaviour monitoring
Beaconing	Proxy and DNS logs	A workstation contacting many low-reputation domains on a short, regular interval shortly after a script ran
Hand-off	Domain controller and identity logs	AD enumeration from a workstation within an hour of a script alert; new privileged accounts; replication requests from non-DC hosts (DCSync); event 7045 service installs

Hunting for the follow-on activity overlaps with the Cobalt Strike Abuse Detection Guide and the BloodHound and Active Directory Attack Path Guide.

Metrics that show the defences work

Script-host coverage: percentage of Windows endpoints with the downloaded-content ASR rule in block mode (target: all user workstations).
Audit-to-block time: days from enabling an ASR rule in audit to block for each ring.
Script execution from downloads: weekly count of wscript or cscript executions of files under user download and temp paths; this should trend towards zero.
Time to contain: minutes from first script-host alert to host isolation, measured against the 15 to 20 minute reconnaissance window in the reports.
Detection depth: number of chain stages with a tested detection, validated in purple-team exercises using benign simulations.

Responding to a GootLoader execution

Because hand-off can follow within minutes, treat a confirmed execution as a potential domain compromise until proven otherwise.

Isolate the host through EDR network containment as soon as script-host execution from a downloaded archive is confirmed. Do not wait for a payload verdict.
Preserve evidence before cleaning: memory capture, the ZIP and .js from the download location, the user's NTUSER.DAT hive (for registry-stored payloads), scheduled tasks, Startup folder contents, PowerShell operational logs and browser history showing the search and landing page.
Scope the hand-off: search for the same user and host in domain controller logs for enumeration, new accounts, group changes and replication requests in the period since execution. Check for the backdoor's proxy traffic and RDP from the host.
Reset credentials of the user and of any account that logged on to the host. If domain-level activity is found, follow a domain compromise plan including the krbtgt account; see Recovering IAM and PAM After Ransomware or Domain Compromise.
Eradicate by reimaging rather than cleaning, given registry and in-memory components.
Feed back: block the landing domain and the C2 domains found, add the lure filename pattern to awareness material, and check whether the ASR rules were in audit on that device.

The broader response process is in the Incident Response Guide.

Where identity fits

GootLoader itself only needs a standard user, but its value to the follow-on actor is the identities it reaches. The documented intrusions harvested stored passwords, dumped the SAM, SYSTEM and SECURITY hives, used Restricted Admin Mode over RDP on a domain controller, created Domain Admin accounts and ran DCSync. Workstations where administrators, service accounts or helpdesk staff have logged on interactively turn a single infection into domain compromise. Keep privileged accounts off user workstations, remove local admin rights, and alert on privileged group changes; see the EDR Guide for host-side coverage and ITDR vs EDR for identity-side detection.

Framework mapping

Framework	Reference	How it applies to GootLoader
MITRE ATT&CK	S1138 Gootloader; T1608.006, T1204.001, T1204.002, T1059.007, T1059.001, T1547.001, T1053.005, T1055.012	Software entry and core techniques for detection coverage mapping
NIST CSF 2.0	PR.PS-05, DE.CM-01, DE.AE-02, RS.MI-01	Prevent unauthorised execution, monitor networks, analyse events, contain
NIST SP 800-53 Rev 5	SI-3, SI-4, CM-7, AT-2, AC-6	Malicious code protection, monitoring, least functionality for script hosts, awareness, least privilege
CIS Controls v8.1	2.7 Allowlist authorised scripts; 9.3 Network-based URL filters; 10.1 Anti-malware software; 14.1 Security awareness programme	Script control, web filtering, endpoint protection and user training
ISO/IEC 27001:2022 Annex A	A.8.7 Protection against malware; A.8.23 Web filtering; A.6.3 Awareness, education and training	Control objectives that cover the chain

Common failure patterns

ASR rules left in audit indefinitely: the rule that would have stopped the chain generates audit events that nobody reviews, so the estate stays exposed.
Treating it as adware clean-up: deleting the .js and closing the ticket while the registry payload, persistence and a follow-on backdoor remain, and the follow-on actor is already enumerating the domain.
Triage with the wrong tool: opening the archive in a different extractor from the one the user had, seeing a text file and declaring a false positive.
Relying on email security: the lure never passes through the mail gateway, so phishing-focused awareness and filtering miss it.
Indicator-only blocking: blocking last month's domains while the operators rotate compromised sites and C2 domains.
Privileged logons on user devices: an administrator or service account session on the infected workstation hands the follow-on actor the domain.

Practitioner checklist

Enable the ASR rule "Block JavaScript or VBScript from launching downloaded executable content" in audit, review, then block on all workstations.
Set .js, .jse, .vbs and .vbe to open in a text editor by policy for users with no scripting need.
Restrict wscript.exe and cscript.exe for standard users through application control once logon scripts are inventoried.
Turn on PowerShell script block logging and keep AMSI enabled; forward events 4103, 4104 and 4698 to the SIEM.
Alert on script hosts spawning PowerShell, large encoded HKCU registry values and new Startup folder shortcuts.
Correlate any script-host alert with domain controller activity from the same user and host for the following 24 hours.
Pre-authorise EDR isolation for confirmed script execution from downloaded archives.
Brief legal, property and finance teams that documents never arrive as .js files inside a ZIP.
Keep privileged and service accounts off user workstations.

GootLoader Malware Guide: SEO Poisoned Legal Documents and JavaScript Delivery