Goot to Loot—How a Gootloader Infection Led to Credential Access

This ReliaQuest assessment documents a Gootloader JavaScript-based initial access campaign that delivered a SystemBC RAT, performed environment discovery and Kerberoasting, attempted LSASS credential dumping and registry hive extraction, and exfiltrated stolen credentials and artifacts to external FTP/HTTP hosts; containment actions prevented further escalation and the report provides IoCs and mitigation recommendations.