Threat intelligence / Malware

Gootloader

[Gootloader](https://attack.mitre.org/software/S1138) is a Javascript-based infection framework that has been used since at least 2020 as a delivery method for the Gootkit banking trojan, [Cobalt Strike](https://attack.mitre.org/software/S0154), [REvil](https://attack.mitre.org/software/S0496), and others. [Gootloader](https://attack.mitre.org/software/S1138) operates on an "Initial Access as a Service" model and has leveraged [SEO Poisoning](https://attack.mitre.org/techniques/T1608/006) to provide access to entities in multiple sectors worldwide including financial, military, automotive, pharmaceutical, and energy.(Citation: Sophos Gootloader)(Citation: SentinelOne Gootloader June 2021)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Gootloader](https://attack.mitre.org/software/S1138) is a Javascript-based infection framework that has been used since at least 2020 as a delivery method for the Gootkit banking trojan, [Cobalt Strike](https://attack.mitre.org/software/S0154), [REvil](https://attack.mitre.org/software/S0496), and others. [Gootloader](https://attack.mitre.org/software/S1138) operates on an "Initial Access as a Service" model and has leveraged [SEO Poisoning](https://attack.mitre.org/techniques/T1608/006) to provide access to entities in multiple sectors worldwide including financial, military, automotive, pharmaceutical, and energy.(Citation: Sophos Gootloader)(Citation: SentinelOne Gootloader June 2021)

Labels

malware

18 recorded

Relationships

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Domain Groups

Technique

uses

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Malicious Link

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Portable Executable Injection

Technique

uses

Technique

uses

to Process Hollowing

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Standard Encoding

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Location Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Time Based Checks

Technique

uses

to Web Services

Technique

3 external

References

mitre-attack

S1138

SentinelOne Gootloader June 2021

https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/

Sophos Gootloader

https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/