Gootloader | Threat Detection Overview

Gootloader has resurfaced using novel evasion (custom WOFF2 glyph-substitution fonts and XOR-encrypted ZIP delivery via compromised WordPress comment endpoints) to deliver JavaScript that spawns PowerShell and VBScript stagers, drops Supper SOCKS5 backdoors, and enables rapid reconnaissance and lateral movement; compromised hosts are frequently handed off to Vanilla Tempest for Domain Admin acquisition and ransomware preparation, with multiple real-world cases showing Domain Controller compromise in as little as 17 hours and complete TTPs and IOCs provided.