Threat video1:00
Gootloader Takedown in Operation Endgame: Detection & IOCs
Operation Endgame removed Gootloader from over 100 servers. Its 9 detection rules, 26 IOCs and 15 ATT&CK techniques include a free Splunk SPL rule.
Read the full threat intel for Gootloader Takedown in Operation Endgame: Detection & IOCs →
Chapters
- 0:00The hookGootloader infected about 25,000 computers.
- 0:04The storyDOJ removed it from over 100 servers.
- 0:10Attack pathFake forum pages, reportedly, lured victims.
- 0:22AttributionAttributed to UNC2565.
- 0:28Indicators of compromise17 indicators to hunt: 3 IPs, 1 domain and 2 URLs, and more.
- 0:35MITRE ATT&CK techniques15 ATT&CK techniques, from resource development to command and control.
- 0:40Remediation6 steps now: Hunt for wscript.exe/cscript.exe executing .js files from user-writable paths.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Gootloader infected about 25,000 computers.
0:05DOJ removed it from over 100 servers.
0:10Fake forum pages, reportedly, lured victims.
0:14A ZIP file, then a JScript loader.
0:17Access was sold to ransomware actors.
0:22Attributed to UNC2565. Confidence: medium.
0:2917 indicators to hunt: 3 IPs, 1 domain and 2 URLs, and more.
0:3515 ATT&CK techniques, from resource development to command and control.
0:416 steps now: Hunt for wscript.exe/cscript.exe executing .js files from user-writable paths.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.