Malware

GootLoader

Also known as: SLOWPOUR

According to PCrisk, they discovered GootLoader malware while examining legitimate but compromised websites (mainly websites managed using WordPress). It was found that GootLoader is used to infect computers with additional malware. Cybercriminals using GootLoader seek to trick users into unknowingly downloading and executing the malware by disguising it as a document or other file.

Indicators of Compromise 2

Domain AVCheck Domain SCKit

Source Articles

Police dismantle Gootloader, CastleRAT, StealC malware infrastructure

Law enforcement agencies from nine countries, coordinated by Europol and Eurojust, dismantled infrastructure associated with the Gootloader, CastleRAT, and StealC malware operations as part of Operation Endgame. The operation resulted in the seizure of 257 domains and 235 servers used by these cybercriminal networks. Authorities identified over 6.4 million stolen victim datasets, including more than 6 million credentials, which were exfiltrated by the malware and intended for use in follow-on attacks such as ransomware. Victims' data will be shared with cybersecurity organizations to enable alerts and remediation, particularly urging WordPress users to update credentials and enable multi-factor authentication.

bleeping-computer ·13h ago