cyber.hendryadrian.com
Threat Research · huntress.com

Huntress Details Gootloader’s Return, WOFF2 Evasion and Rapid Domain Controller Compromise

· Original article ↗

Summary

Huntress observed three Gootloader infections since Oct. 27; two led to hands-on intrusions and Domain Controller compromise within 17 hours, with one partner-observed case under an hour. The loader uses WOFF2 glyph substitution and encrypted ZIP delivery.

Key points

  • Huntress observed three Gootloader infections since Oct. 27; two led to hands-on-keyboard intrusions and Domain Controller compromise. One Huntress case reached the controller in about 17 hours; a partner-observed case did so in under an hour.
  • SEO-poisoned searches led users to compromised sites, where Gootloader abused WordPress comment submission endpoints to deliver XOR-encrypted ZIP archives.
  • A custom embedded WOFF2 font swaps glyph shapes to make obfuscated source characters render as plausible filenames, hindering static string searches.
  • The loader collects environment variables, visible process window titles, desktop files, and mounted drives; it selects among ten C2 domains and checks in every 20 seconds.
  • Gootloader shifted persistence from scheduled tasks to Startup-folder shortcuts, created roughly 10–20 minutes after execution, with Windows 8.3 short filenames used in references.
  • Supper provides SOCKS5 tunneling and remote shell access; its obfuscation includes API hammering, runtime shellcode construction, API hashing, and custom LZMA decompression.
  • Observed post-compromise activity included Active Directory reconnaissance, lateral movement via WinRM, privileged account creation, and Volume Shadow Copy enumeration; a partner also observed an NTDS database dump.

Article Details

Attack Vectors
  • SEO poisoning directed users to compromised websites that delivered Gootloader through WordPress comment submission endpoints.
  • The compromised sites delivered XOR-encrypted ZIP archives containing JavaScript payloads; the payload filenames were obfuscated using a custom WOFF2 font with glyph substitution.
  • Gootloader used obfuscated JavaScript and PowerShell to collect host information and communicate with C2 servers.
  • Supper provided SOCKS5 proxying and remote shell access; observed follow-on activity included Active Directory reconnaissance, Kerberoasting, WinRM lateral movement, privileged account creation, and DCSync.
  • In a DFIRReport-observed intrusion, a malicious proxy DLL and scheduled task were used for persistence, followed by NTDS.dit dumping and cleanup.
Defensive Notes
  • Monitor unusual PowerShell execution and Active Directory enumeration, including SPN searches, Kerberoasting, and domain-wide local administrator checks.
  • Watch for WinRM lateral movement, unexpected privileged-account creation, Volume Shadow Copy enumeration, and DCSync activity.
  • Monitor endpoint activity for Startup-folder persistence, suspicious scheduled tasks, and event-log clearing.
  • The article notes that reconnaissance began about 20 minutes after infection and that domain-controller compromise occurred within 17 hours in one case and under an hour in another; it recommends monitoring these repeatable behaviors.

Indicators of compromise

TypeIndicatorContext
IPV4103[.]253[.]42[.]91Hardcoded C2 IP for the Supper backdoor.
IPV4146[.]19[.]49[.]177Hardcoded C2 IP for the Supper backdoor.
IPV4178[.]32[.]224[.]219C2 IP listed among the indicators associated with the Gootloader and Supper activity.
IPV4193[.]104[.]58[.]64C2 IP listed among the indicators associated with the Gootloader and Supper activity.
IPV4213[.]232[.]236[.]138Hardcoded C2 IP for the Supper backdoor.
IPV437[.]59[.]205[.]2C2 IP listed among the indicators associated with the Gootloader and Supper activity.
IPV491[.]236[.]230[.]134Hardcoded C2 IP for the Supper backdoor.
SHA2562f056ce0657542da3e7e43fb815a8973c354624043f19ef134dff271db1741b3SHA-256 hash listed for a Gootloader secondary JavaScript file.
SHA25639d980851be1e111c035e4db2589fa3d5f59a5bef7b7b3e36bff5435c78f7049SHA-256 hash listed for a Gootloader secondary JavaScript file.
SHA2565ec9e926d4fb4237cf297d0d920cf0e9a5409f0226ee555bd8c89b97a659f4b0SHA-256 hash listed for a Gootloader secondary JavaScript file.
SHA2567557d5fed880ee1e292aba464ffdc12021f9acbe0ee3a2313519ecd7f94ec5c4SHA-256 hash listed for a Gootloader secondary JavaScript file.
SHA25687cbe9a5e9da0dba04dbd8046b90dbd8ee531e99fd6b351eae1ae5df5aa67439SHA-256 hash listed for a Gootloader initial JavaScript file.
SHA256ad88076fd75d80e963d07f03d7ae35d4e55bd49634baf92743eece19ec901e94SHA-256 hash listed for a Gootloader initial JavaScript file.
SHA256b9a61652dffd2ab3ec3b7e95829759fc43665c27e9642d4b2d4d2f7287254034SHA-256 hash listed for a Gootloader secondary JavaScript file.
SHA256c2326db8acae0cf9c5fc734e01d6f6c1cd78473b27044955c5761ec7fd479964SHA-256 hash listed for a Gootloader initial JavaScript file.
SHA256c2b9782c55f75bb1797cb4fbae0290b44d0fcad51bf4f2c11c52ebbe3526d2acSHA-256 hash listed for a Gootloader initial JavaScript file.
SHA256cf44aa11a17b3dad61cae715f4ea27c0cbf80732a1a7a1c530a5c9d3d183482aSHA-256 hash listed for a Supper backdoor sample.
URLhxxp[:]//cookcountyjudges[.]org/Gootloader C2 URL; the article identifies its domain as one of ten extracted C2 domains.
URLhxxps[:]//cortinaspraga[.]com/Gootloader C2 URL; the article identifies its domain as one of ten extracted C2 domains.
URLhxxps[:]//espressonisten[.]de/Gootloader C2 URL; the article identifies its domain as one of ten extracted C2 domains.
URLhxxps[:]//hotporntv[.]net/Gootloader C2 URL; the article identifies its domain as one of ten extracted C2 domains.
URLhxxps[:]//influenceimmo[.]com/Gootloader C2 URL; the article identifies its domain as one of ten extracted C2 domains.
URLhxxps[:]//jungutah[.]com/Gootloader C2 URL; the article identifies its domain as one of ten extracted C2 domains.
URLhxxps[:]//tiresdoc[.]com/Gootloader C2 URL; the article identifies its domain as one of ten extracted C2 domains.
URLhxxps[:]//tokyocheapo[.]com/Gootloader C2 URL; the article identifies its domain as one of ten extracted C2 domains.
URLhxxps[:]//x[.]fybw[.]org/Gootloader C2 URL; the article identifies its domain as one of ten extracted C2 domains.
URLhxxps[:]//yourboxspring[.]nl/Gootloader C2 URL; the article identifies its domain as one of ten extracted C2 domains.

MITRE ATT&CK

T1003.003 · NTDSIn a DFIRReport-observed intrusion, the threat actor used ntdsutil to dump the NTDS.dit database.T1003.006 · DCSyncThe threat actor performed a DCSync attack using existing Domain Admin privileges.T1021.006 · Windows Remote ManagementThe threat actor moved laterally to a domain controller via WinRM.T1027 · Obfuscated Files or InformationGootloader obfuscated JavaScript and filenames using noisy string fragments, encrypted ZIP payloads, and a custom WOFF2 font with glyph substitution.T1053.005 · Scheduled TaskIn a DFIRReport-observed intrusion, a scheduled task running as SYSTEM established persistence on a domain controller.T1059.001 · PowerShellGootloader launched PowerShell to collect host data, beacon to C2, and execute received commands.T1059.005 · Visual BasicA VBScript wrapper checked its execution environment and launched PowerShell.T1059.007 · JavaScriptThe infection chain executed initial and secondary JavaScript payloads.T1070.001 · Clear Windows Event LogsIn a DFIRReport-observed intrusion, the threat actor cleared event logs during cleanup.T1087.002 · Domain AccountThe threat actor enumerated domain users and groups, including Domain Admins, and searched Active Directory account descriptions.T1105 · Ingress Tool TransferCompromised WordPress sites delivered XOR-encrypted ZIP payloads through the comment submission endpoint.T1136.002 · Domain AccountThe threat actor created the sccmad account on a domain controller and added it to Domain Admins and local Administrators.T1189 · Drive-by CompromiseGootloader was delivered when users reached compromised websites through SEO-poisoned search results.T1547.001 · Registry Run Keys / Startup FolderGootloader created persistence using shortcuts in the Startup folder.T1558.003 · KerberoastingThe threat actor ran a Kerberoasting command to obtain crackable password hashes.

People

Anna PhamNamed as the author of the Huntress article.

Threat Actors

DEV-0832Earlier tracking name for Vanilla Tempest, according to the article.Storm-0494MSTIC-tracked threat actor described as operating Gootloader and providing initial access.Vanilla TempestThreat actor described as taking access from Gootloader infections for post-exploitation and ransomware activity; previously tracked as DEV-0832.

Malware

BlackCatVanilla Tempest has been active since 2022 and delivers different ransomware families, including Rhysida (commonly observed in Gootloader post-intrusion activity), BlackCat, Zeppelin, and Quantum Locker.BroomstickThese samples are attributed to OysterLoader (also known as CleanUpLoader or Broomstick), another backdoor that Vanilla Tempest refuses to quit using.GootloaderGootloader Returns: What Goodies Did They Bring?OysterLoaderThese samples are attributed to OysterLoader (also known as CleanUpLoader or Broomstick), another backdoor that Vanilla Tempest refuses to quit using.Quantum LockerVanilla Tempest has been active since 2022 and delivers different ransomware families, including Rhysida (commonly observed in Gootloader post-intrusion activity), BlackCat, Zeppelin, and Quantum Locker.RhysidaVanilla Tempest has been active since 2022 and delivers different ransomware families, including Rhysida (commonly observed in Gootloader post-intrusion activity), BlackCat, Zeppelin, and Quantum Locker.SupperSupper SOCKS5 Backdoor—Vanilla Tempest's Tool of Choice contains extensive obfuscation: API hammering, runtime shellcode construction, API hashing, and custom 2-byte LZMA compressionZeppelinVanilla Tempest has been active since 2022 and delivers different ransomware families, including Rhysida (commonly observed in Gootloader post-intrusion activity), BlackCat, Zeppelin, and Quantum Locker.

Products

Microsoft WindowsMoved from scheduled tasks to Startup folder persistence mechanism and still using Windows 8.3 short filenamesPowerShellthrough deobfuscation of the multi-layered payload, we were able to produce a readable second-stage PowerShell script and extract all ten C2 domains (Figure 5).WordPressExploits WordPress comment endpoints to deliver XOR-encrypted ZIP payloads with unique keys per file

Tools

ImpacketThe threat actor then leveraged Impacket to remotely execute the following command on the Domain Controller:LeCMDFigure 7: Overview of the shortcut file using LECmd toolYARAFurther hunting with the Yara rule revealed additional samples using the same obfuscation.

Related Articles