Gootloader Malware Disrupted in International Operation (Operation Endgame) After Infecting 25,000+ Computers

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5976 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Gootloader JScript Executed by wscript/cscript from User-Writable Path — Exploitation

Detects Windows Script Host (wscript.exe/cscript.exe) running a .js/.jse file from Downloads, %APPDATA%\Roaming, %TEMP% or an archive-extraction folder (Temp1_*.zip). This is the Gootloader execution trigger: the victim opens the search-query-named ZIP from a poisoned WordPress page and double-clicks the ~296KB JScript (jQuery/Underscore padded). Also surfaces the second-stage re-launch from %APPDATA%\Roaming. Source: Sophos X-Ops, Zscaler/Red Canary, DOJ release 26-1351.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1059.007, T1027
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\wscript.exe" OR Image="*\\cscript.exe") CommandLine="*.js*"
| where match(CommandLine,"(?i)\\.jse?(\\W|$)") AND match(CommandLine,"(?i)(\\\\Downloads\\\\|\\\\AppData\\\\Roaming\\\\|\\\\AppData\\\\Local\\\\Temp\\\\|\\\\Temp[0-9]+_)")
| eval launch_context=case(match(ParentImage,"(?i)\\\\(explorer|7zFM|WinRAR|winzip64)\\.exe$"),"user_double_click_or_archive_extract",match(ParentImage,"(?i)\\\\(wscript|cscript|powershell)\\.exe$"),"script_host_chain",true(),"other")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host User Image launch_context
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine matches regex @'(?i)\.jse?(\W|$)'
| where ProcessCommandLine matches regex @'(?i)(\\Downloads\\|\\AppData\\Roaming\\|\\AppData\\Local\\Temp\\|\\Temp\d+_)'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Gootloader JScript Executed by Windows Script Host from User-Writable Path
id: 7c1e4a52-3b9d-4f0a-8a61-5d2e9b7c1a01
status: experimental
description: Detects wscript.exe or cscript.exe executing a .js file from Downloads, AppData Roaming/Temp or an archive extraction folder, the Gootloader JScript execution pattern.
references:
  - https://www.justice.gov/opa/pr/gootloader-malware-disrupted-international-cyber-operation
  - https://www.sophos.com/en-us/blog/gootloader-inside-out
  - https://www.zscaler.com/blogs/cybersecurity-best-practices/gootloader
  - https://redcanary.com/threat-detection-report/threats/gootloader/
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.007
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_js:
    CommandLine|contains:
      - '.js'
  selection_path:
    CommandLine|contains:
      - '\Downloads\'
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
      - '\Temp1_'
      - '\Temp2_'
      - '\Temp3_'
  condition: selection_img and selection_js and selection_path
falsepositives:
  - Administrators running legitimate logon or deployment .js scripts from a user profile
  - Developers testing JScript from the Downloads folder
level: high

Known false positives:

• Administrators running legitimate .js logon or deployment scripts from a user profile
• Developers or help-desk staff testing JScript files from the Downloads folder

Tuning notes: Exclude known-good script paths and signed internal automation by CommandLine or hash. Where Windows Script Host is already blocked for standard users this should be near zero, so raise the alert priority. Restrict to AD-joined hosts to match Gootloader's USERDNSDOMAIN guardrail.

• 🔒 Gootloader Script-Host to PowerShell Chain with Bare and Encoded PowerShell — Exploitation · unlock with TL Creds
• 🔒 Gootloader Payload Staged in HKCU Software\Microsoft\Phone Registry Key — Post-Exploitation · unlock with TL Creds
• 🔒 UNC2565 Post-Compromise Kerberoasting and BloodHound AD Enumeration — Lateral Movement · unlock with TL Creds
• 🔒 Compromised WordPress Hello_Dolly Plugin POST Command Shell — Gootloader Infrastructure · unlock with TL Creds
• 🔒 PowerShell Reflective .NET Load From Registry (Gootloader Stage 2) — Post-Exploitation · unlock with TL Creds
• 🔒 Connections to Gootloader Mothership Infrastructure and Community-Related Cobalt Strike IPs — C2 · unlock with TL Creds
• 🔒 Gootloader Scheduled Task Persistence Running cscript/wscript Against JS in AppData — Post-Exploitation · unlock with TL Creds
• 🔒 Cobalt Strike Beacon in rundll32.exe Launched With No Arguments Making External Connections — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5976.

Sample indicators (3 of 26)

• IP address: 5.8.18[.]7
• Domain: my-game[.]biz
• File hash: c20a040acb10e820cfaaa086bdc807ffed6241bc5d0fc9e11a02a5d355125df0

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

Gootloader is a JScript-based malware loader and part of the GootKit malware family (active since 2014). Mandiant tracks the GootKit operators as UNC2565; IBM X-Force tracks them as Hive0127. According to the U.S. Department of Justice (Press Release 26-1351, 2026-11-12), Gootloader infected at least 25,000 computers worldwide since 2018, forming a botnet whose operators used it to infect further machines and sold access to ransomware actors. It was used in ransomware attacks on at least 44 U.S.-based victims with approximately $28.8 million in losses; reported victims included the U.S. Department of War and the Defense Industrial Base. DOJ's operation, coordinated with Operation Endgame, removed Gootloader from more than 100 servers, including compromised WordPress sites, and seized U.S. domain names used to deliver and control the malware. Seized domains now display a law-enforcement banner. The DOJ release does not name the seized domains, server IPs, hashes or ransomware groups.

Delivery chain (per Sophos X-Ops, Zscaler/Red Canary and Cybereason): operators compromise legitimate WordPress sites and use SEO poisoning so the pages rank for business/legal-document search phrases (contract templates, agreements, freeware installers). Victims land on a fake forum-style 'Questions and Answers' page that links to a ZIP archive named after the search query. Sophos reports the injected PHP (suspected modified Hello Dolly plugin at wp-content/plugins/Hello_Dolly/HelloDolly.php) contains a base64 POST-driven command shell, geofences visitors, blocks each visitor /24 for 24 hours via a backend table (backupdb_wp_lstat), and reports server ID, visitor IP, user agent and referrer to a 'mothership' (domain my-game.biz, IPs 5.8.18.7, 5.8.18.159, 91.215.85.52 in the Sophos sample set). X-Force reports hacked WordPress sites also act as C2 with URL paths ending in /xmlrpc.php. Visitors outside targeted countries are redirected to Google.

Endpoint execution (Zscaler/Red Canary): wscript.exe runs a roughly 296KB JScript file (malicious code spliced into jQuery, later Underscore.JS). The script checks the USERDNSDOMAIN environment variable and only continues deeper for Active Directory-joined hosts. A second JScript stage embeds a .NET DLL and a Cobalt Strike beacon or other component, stored in the registry (obfuscated HKCU path decoding to software\microsoft\Phone\<username>0). In newer campaigns wscript.exe writes a randomly named .log/.js file under %APPDATA%\Roaming in a folder named after legitimate software, unpacks a second .js, and creates a scheduled task; cscript.exe runs the second script and launches PowerShell with no command line, which spawns a second PowerShell with an encoded command that reads the DLL from the registry, reflectively loads it with Assembly.Load and calls Test(). The scheduled task re-runs the chain at logon. Cobalt Strike beacons have been injected into rundll32.exe launched with no arguments. Follow-on payloads reported include Gootkit, Cobalt Strike and Osiris (Zscaler) and IcedID, Cobalt Strike and SystemBC (X-Force). Post-compromise, UNC2565 performed reconnaissance and credential theft using Kerberoasting and BloodHound (Cybereason). Security Affairs reports ransomware and trojans associated with the access-as-a-service model: SunCrypt, REvil (Sodinokibi) and the Kronos trojan.

The takedown was supported by Shadowserver Foundation (infected-host identification and victim notification via ISPs and CSIRTs), Fraunhofer FKIE, ICHIP The Hague, Registrar of Last Resort, OpenAI and Sharktech. Defenders should expect re-emergence on new infrastructure; legacy indicators below come from earlier public research (Sophos) and may be stale. BeaconBeagle lookups returned HTTP 502 during this research and were not completed.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1480 Execution Guardrails; T1620 Reflective Code Loading

Persistence

T1053.005 Scheduled Task; T1505.003 Web Shell

Execution

T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File

Discovery

T1069.002 Domain Groups

Command and Control

T1071.001 Web Protocols

defense-impairment

T1112 Modify Registry

Credential Access

T1558.003 Kerberoasting

Resource Development

T1584 Compromise Infrastructure; T1608.006 SEO Poisoning

Remediation

Patches

• No CVE or vendor patch is associated with Gootloader itself; keep WordPress core, plugins and themes patched

Immediate actions

• Hunt for wscript.exe/cscript.exe executing .js files from user-writable paths (Downloads, %APPDATA%\Roaming, temp archive extraction folders)
• Alert on wscript.exe spawning cscript.exe or powershell.exe, and on PowerShell with no command line spawning a second PowerShell with an encoded command
• Hunt for rundll32.exe launched with no arguments making network connections
• Search HKCU for the obfuscated payload key under software\microsoft\Phone\ and for scheduled tasks launching cscript.exe against JS files in %APPDATA%
• Audit WordPress sites for modified Hello_Dolly plugin (HelloDolly.php), unexpected POST handlers, a backupdb_wp_lstat table and j$k<number>j$k markers in OpenGraph metadata
• Act on Shadowserver victim notifications and reimage or fully remediate infected hosts; treat Active Directory credentials on affected hosts as compromised

Workarounds

• Block ZIP archives containing .js files at web/email gateways
• Restrict wscript.exe/cscript.exe via AppLocker or WDAC for standard users

Longer-term hardening

• Remove or restrict Windows Script Host and change the default .js file association so downloaded JScript opens in a text editor rather than executing
• Deploy EDR with behavioral detection for script-host to PowerShell chains and reflective .NET loading
• Detect Kerberoasting and BloodHound-style AD enumeration; enforce strong service-account passwords
• Harden WordPress: patch core/plugins/themes, enforce MFA on admin accounts, monitor file integrity of plugin directories

Affected and fixed versions

• Microsoft — Windows (Windows Script Host endpoints, particularly Active Directory-joined hosts)
  Vulnerable versions: Not version-specific
• WordPress — Compromised WordPress websites used for lure hosting and C2
  Vulnerable versions: Compromised sites (initial access vector unconfirmed)

Timeline

• 2014-01-01 GootKit malware family active since 2014 (year only stated by Security Affairs / X-Force); the Gootloader mothership domain was originally registered as a 2014 Russian gambling site per Sophos.
• 2018-01-01 Per DOJ, Gootloader begins infecting computers in 2018 (year only stated); the Sophos-described mothership domain also dates to 2018 and Sucuri publishes early research on the malicious SEO technique.
• 2020-01-01 Independent researcher research on Gootloader's SEO-poisoning delivery published (Rich Infante, 2020, as cited by Sophos; year only).
• 2026-11-12 DOJ states at least 25,000 infections since 2018 and at least 44 U.S. ransomware victims with about $28.8 million in losses, including the Department of War and the Defense Industrial Base.
• 2026-11-12 DOJ Press Release 26-1351 announces the disruption, coordinated with Operation Endgame, with seizure of U.S. domains used to deliver and control the malware and a seizure banner displayed on them.
• 2026-11-12 Warrants authorizing the disruption were unsealed the week of the announcement; Gootloader removed from over 100 servers including compromised WordPress sites.
• 2026-11-13 Security Affairs reports the operation and links Gootloader to SunCrypt, REvil, Kronos and Cobalt Strike; Shadowserver works with ISPs and CSIRTs on victim notification and cleanup.

Sources cited

• Gootloader Malware Disrupted in International Cyber Operation (U.S. DOJ, Press Release 26-1351) justice.gov · Advisory · 2026-11-12
• Operation Endgame operation-endgame.com · Advisory
• Gootloader Inside Out (Sophos X-Ops) Sophos · Research
• Gootloader (Zscaler / Red Canary analysis) zscaler.com · Research
• THREAT ALERT: GootLoader - SEO Poisoning and Large Payloads Leading to Compromise (Cybereason) cybereason.com · Vendor report
• Red Canary Threat Detection Report: Gootloader redcanary.com · Vendor report
• Gootloader Malware Disrupted After Infecting 25,000 Computers (Security Affairs) securityaffairs.com · News · 2026-11-13

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• Fake GTA 6 PC download delivers WARDEN Stealer (Steam, Roblox, browser and crypto wallet data theft) Previous report