Gootloader: SEO Poisoning That Turns a Legal Search Into a Breach

Gootloader is a heavily obfuscated JavaScript first-stage loader descended from the Gootkit banking-trojan ecosystem. Sophos coined the name in 2021 after the operators pivoted from dropping Gootkit to running a broader access-as-a-service loader. It is distributed almost entirely through SEO poisoning: operators compromise legitimate, often WordPress, sites and manipulate rankings so victims searching for legal and business documents land on an attacker-controlled fake forum page pushing a malicious ZIP containing a .js file. Running that script begins a multi-stage chain leading to post-exploitation tooling and, frequently, ransomware. The operator cluster is tracked as UNC2565.

Overview & Timeline

• ~2014. Gootkit banking trojan active.
• 2021. Sophos names the Gootloader delivery framework as operators shift to loader-as-access.
• 2022. SEO-poisoning intrusions delivering Cobalt Strike documented (DFIR Report, Cybereason).
• Mar 2025. Activity spikes then pauses around 31 March, attributed to a researcher’s takedown efforts.
• Oct 2025. Huntress reports a resurgence after a roughly seven-month break, delivering the Supper SOCKS5 backdoor and leading to fast hands-on-keyboard intrusions linked to Vanilla Tempest and Rhysida.

How It Works

• SEO poisoning and cloaking: compromised sites serve different content to crawlers and victims and gate delivery (one download per IP, geofencing). T1608.006 T1189
• Stage one is an obfuscated .js run by wscript.exe; later stages are staged in the Windows registry and executed via PowerShell, often loading Cobalt Strike in memory. T1059.007 T1112 T1059.001
• Persistence historically via scheduled task; the 2025 variant shifted to Startup-folder shortcuts and used 8.3 short filenames to obscure paths. T1547.001
• 2025 novelties: custom WOFF2 web fonts that visually remap displayed filenames, and XOR-encrypted ZIPs delivered through WordPress comment endpoints.

MITRE ATT&CK Mapping

Detection & Mitigation

• Change the default handler for .js and .jse to Notepad and disable Windows Script Host where feasible; apply application control.
• Alert on wscript.exe spawning from a ZIP-extracted .js in Downloads, and on wscript-to-powershell chains reading large registry blobs.
• Web filtering and user training against “download this document template” search lures; hunt for Cobalt Strike beaconing after the loader stage.