# Gootloader Malware Disrupted in International Operation (Operation Endgame) After Infecting 25,000+ Computers

> On 2026-11-12 the U.S. DOJ announced that, with international partners and in coordination with Operation Endgame, it removed Gootloader from over 100 servers (including compromised WordPress sites) and seized U.S. domains used to deliver and control it. Since 2018 Gootloader infected at least 25,000 computers and functioned as an access-as-a-service botnet for ransomware actors, tied to at least 44 U.S. ransomware victims and about $28.8 million in losses.

- **Published:** 2026-11-13T16:13:24Z
- **Last reviewed:** 2026-11-13T16:13:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5976
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5976.png
- **ID:** TL-2026-5976
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** UNC2565
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

Gootloader is a JScript-based malware loader and part of the GootKit malware family (active since 2014). Mandiant tracks the GootKit operators as UNC2565; IBM X-Force tracks them as Hive0127. According to the U.S. Department of Justice (Press Release 26-1351, 2026-11-12), Gootloader infected at least 25,000 computers worldwide since 2018, forming a botnet whose operators used it to infect further machines and sold access to ransomware actors. It was used in ransomware attacks on at least 44 U.S.-based victims with approximately $28.8 million in losses; reported victims included the U.S. Department of War and the Defense Industrial Base. DOJ's operation, coordinated with Operation Endgame, removed Gootloader from more than 100 servers, including compromised WordPress sites, and seized U.S. domain names used to deliver and control the malware. Seized domains now display a law-enforcement banner. The DOJ release does not name the seized domains, server IPs, hashes or ransomware groups.

Delivery chain (per Sophos X-Ops, Zscaler/Red Canary and Cybereason): operators compromise legitimate WordPress sites and use SEO poisoning so the pages rank for business/legal-document search phrases (contract templates, agreements, freeware installers). Victims land on a fake forum-style 'Questions and Answers' page that links to a ZIP archive named after the search query. Sophos reports the injected PHP (suspected modified Hello Dolly plugin at wp-content/plugins/Hello_Dolly/HelloDolly.php) contains a base64 POST-driven command shell, geofences visitors, blocks each visitor /24 for 24 hours via a backend table (backupdb_wp_lstat), and reports server ID, visitor IP, user agent and referrer to a 'mothership' (domain my-game.biz, IPs 5.8.18.7, 5.8.18.159, 91.215.85.52 in the Sophos sample set). X-Force reports hacked WordPress sites also act as C2 with URL paths ending in /xmlrpc.php. Visitors outside targeted countries are redirected to Google.

Endpoint execution (Zscaler/Red Canary): wscript.exe runs a roughly 296KB JScript file (malicious code spliced into jQuery, later Underscore.JS). The script checks the USERDNSDOMAIN environment variable and only continues deeper for Active Directory-joined hosts. A second JScript stage embeds a .NET DLL and a Cobalt Strike beacon or other component, stored in the registry (obfuscated HKCU path decoding to software\microsoft\Phone\<username>0). In newer campaigns wscript.exe writes a randomly named .log/.js file under %APPDATA%\Roaming in a folder named after legitimate software, unpacks a second .js, and creates a scheduled task; cscript.exe runs the second script and launches PowerShell with no command line, which spawns a second PowerShell with an encoded command that reads the DLL from the registry, reflectively loads it with Assembly.Load and calls Test(). The scheduled task re-runs the chain at logon. Cobalt Strike beacons have been injected into rundll32.exe launched with no arguments. Follow-on payloads reported include Gootkit, Cobalt Strike and Osiris (Zscaler) and IcedID, Cobalt Strike and SystemBC (X-Force). Post-compromise, UNC2565 performed reconnaissance and credential theft using Kerberoasting and BloodHound (Cybereason). Security Affairs reports ransomware and trojans associated with the access-as-a-service model: SunCrypt, REvil (Sodinokibi) and the Kronos trojan.

The takedown was supported by Shadowserver Foundation (infected-host identification and victim notification via ISPs and CSIRTs), Fraunhofer FKIE, ICHIP The Hague, Registrar of Last Resort, OpenAI and Sharktech. Defenders should expect re-emergence on new infrastructure; legacy indicators below come from earlier public research (Sophos) and may be stale. BeaconBeagle lookups returned HTTP 502 during this research and were not completed.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1608.006 SEO Poisoning
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1505.003 Web Shell
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1620 Reflective Code Loading
- T1480 Execution Guardrails
- T1055 Process Injection
- T1558.003 Kerberoasting
- T1069.002 Domain Groups
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Gootloader JScript Executed by wscript/cscript from User-Writable Path — Exploitation** (`TL-2026-5976-SPL-001`)

Detects Windows Script Host (wscript.exe/cscript.exe) running a .js/.jse file from Downloads, %APPDATA%\Roaming, %TEMP% or an archive-extraction folder (Temp1_*.zip). This is the Gootloader execution trigger: the victim opens the search-query-named ZIP from a poisoned WordPress page and double-clicks the ~296KB JScript (jQuery/Underscore padded). Also surfaces the second-stage re-launch from %APPDATA%\Roaming. Source: Sophos X-Ops, Zscaler/Red Canary, DOJ release 26-1351.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.007, T1027
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\wscript.exe" OR Image="*\\cscript.exe") CommandLine="*.js*"
| where match(CommandLine,"(?i)\\.jse?(\\W|$)") AND match(CommandLine,"(?i)(\\\\Downloads\\\\|\\\\AppData\\\\Roaming\\\\|\\\\AppData\\\\Local\\\\Temp\\\\|\\\\Temp[0-9]+_)")
| eval launch_context=case(match(ParentImage,"(?i)\\\\(explorer|7zFM|WinRAR|winzip64)\\.exe$"),"user_double_click_or_archive_extract",match(ParentImage,"(?i)\\\\(wscript|cscript|powershell)\\.exe$"),"script_host_chain",true(),"other")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host User Image launch_context
| convert ctime(first_seen) ctime(last_seen)
| sort - count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine matches regex @'(?i)\.jse?(\W|$)'
| where ProcessCommandLine matches regex @'(?i)(\\Downloads\\|\\AppData\\Roaming\\|\\AppData\\Local\\Temp\\|\\Temp\d+_)'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Gootloader JScript Executed by Windows Script Host from User-Writable Path
id: 7c1e4a52-3b9d-4f0a-8a61-5d2e9b7c1a01
status: experimental
description: Detects wscript.exe or cscript.exe executing a .js file from Downloads, AppData Roaming/Temp or an archive extraction folder, the Gootloader JScript execution pattern.
references:
  - https://www.justice.gov/opa/pr/gootloader-malware-disrupted-international-cyber-operation
  - https://www.sophos.com/en-us/blog/gootloader-inside-out
  - https://www.zscaler.com/blogs/cybersecurity-best-practices/gootloader
  - https://redcanary.com/threat-detection-report/threats/gootloader/
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.007
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_js:
    CommandLine|contains:
      - '.js'
  selection_path:
    CommandLine|contains:
      - '\Downloads\'
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
      - '\Temp1_'
      - '\Temp2_'
      - '\Temp3_'
  condition: selection_img and selection_js and selection_path
falsepositives:
  - Administrators running legitimate logon or deployment .js scripts from a user profile
  - Developers testing JScript from the Downloads folder
level: high

```

**Known false positives:**

- Administrators running legitimate .js logon or deployment scripts from a user profile
- Developers or help-desk staff testing JScript files from the Downloads folder

**Tuning notes:** Exclude known-good script paths and signed internal automation by CommandLine or hash. Where Windows Script Host is already blocked for standard users this should be near zero, so raise the alert priority. Restrict to AD-joined hosts to match Gootloader's USERDNSDOMAIN guardrail.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Gootloader Script-Host to PowerShell Chain with Bare and Encoded PowerShell — Exploitation (locked: unlock with TL Creds)
- Gootloader Payload Staged in HKCU Software\Microsoft\Phone Registry Key — Post-Exploitation (locked: unlock with TL Creds)
- UNC2565 Post-Compromise Kerberoasting and BloodHound AD Enumeration — Lateral Movement (locked: unlock with TL Creds)
- Compromised WordPress Hello_Dolly Plugin POST Command Shell — Gootloader Infrastructure (locked: unlock with TL Creds)
- PowerShell Reflective .NET Load From Registry (Gootloader Stage 2) — Post-Exploitation (locked: unlock with TL Creds)
- Connections to Gootloader Mothership Infrastructure and Community-Related Cobalt Strike IPs — C2 (locked: unlock with TL Creds)
- Gootloader Scheduled Task Persistence Running cscript/wscript Against JS in AppData — Post-Exploitation (locked: unlock with TL Creds)
- Cobalt Strike Beacon in rundll32.exe Launched With No Arguments Making External Connections — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `5.8.18[.]7`
- Domain: `my-game[.]biz`
- File hash: `c20a040acb10e820cfaaa086bdc807ffed6241bc5d0fc9e11a02a5d355125df0`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Gootloader Malware Disrupted in International Cyber Operation (U.S. DOJ, Press Release 26-1351)](https://www.justice.gov/opa/pr/gootloader-malware-disrupted-international-cyber-operation)
- [Gootloader Malware Disrupted After Infecting 25,000 Computers (Security Affairs)](https://securityaffairs.com/202997/cyber-crime/gootloader-malware-disrupted-after-infecting-25000-computers.html)
- [Gootloader Inside Out (Sophos X-Ops)](https://www.sophos.com/en-us/blog/gootloader-inside-out)
- [Gootloader (Zscaler / Red Canary analysis)](https://www.zscaler.com/blogs/cybersecurity-best-practices/gootloader)
- [THREAT ALERT: GootLoader - SEO Poisoning and Large Payloads Leading to Compromise (Cybereason)](https://cybereason.com/blog/i-am-goot-loader)
- [Red Canary Threat Detection Report: Gootloader](https://redcanary.com/threat-detection-report/threats/gootloader/)
- [Operation Endgame](https://www.operation-endgame.com/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5976