What We Do
How we do it
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
Jun 03, 2022
UPDATE: CVE-2022-26134 – Confluence Zero-Day Vulnerability
THE THREAT June 3rd Update: Atlassian has released security patches to address this vulnerability. On June 2nd, 2022, Atlassian disclosed a critical vulnerability impacting the Confluence…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1200+ organizations in 75+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
May 17, 2022
Cybersecurity Leader eSentire Continues Its Commitment to Rigorous Security Standards Earning PCI DSS Certification
Waterloo, ON, May 17, 2022 — eSentire, the Authority in Managed Detection and Response (MDR), maintains one of the most secure and robust IT environments of any MDR provider in the industry. To that end, eSentire today announced that it has received the Payment Card Industry Data Security Standard (PCI DSS) certification, considered one of the most stringent and comprehensive payment card…
Read More
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Security advisories — Jan 06, 2022

Increase in GootLoader Malware

2 minutes read
Speak With A Security Expert Now


eSentire has identified an increase in the GootLoader malware impacting organizations in the Legal services industry. GootLoader is an initial access malware that leads to the Gootkit Remote Access Trojan (RAT). It is delivered through drive-by social engineering attacks. This malware has been observed as a precursor to other threats including the Cobalt Strike red-team tool and the REvil ransomware.

Organizations are strongly encouraged to review the recommendations section of this advisory and ensure employees are aware of best security practices when searching for online documents.

What we’re doing about it

What you should do about it

Additional information

The threat actors behind this campaign employ Search Engine Optimization (SEO) poisoning in order to direct users searching for specific document templates to a malicious version (see Figure 1). Downloading and opening the malicious file leads to the deployment of GootLoader. Recently observed malicious templates focus on “agreements” as a key term, but other keywords are likely in use. The full infection chain can be found below.

Typical Infection Process:

  1. User performs a web search for a document or document template
  2. User clicks on search result leading to GootLoader landing page
  3. Landing page presents a fake web forum and link to the requested document
  4. User clicks on the presented link, receives a Zip archive
  5. User opens the archive, finds a JavaScript file (.js extension) disguised as the requested document
  6. User executes the JavaScript file by double-clicking it
  7. Windows executes the JavaScript file using the Windows script host process, resulting in execution of the GootLoader malware

Quickly identifying and remediating GootLoader infections is critical in preventing follow on attacks and the deployment of more damaging malware such as ransomware. Additional details on GootLoader tactics can be found in the eSentire report “GootLoader Hackers Poison Websites Globally in Order to Infect Business Professionals with Ransomware, Intrusion Tools and Bank Trojans”.

Indicators of Compromise
human-to-dust[.]dePayload Delivery
szandyhercegno[.]huPayload Delivery
jonathanbartz[.]comCommand and Control

Figure 1: GootLoader Infection Process – Search Engine results leading to GootLoader distribution page and corresponding Zip archive leading to malicious Java Script.


[1] https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide#block-javascript-or-vbscript-from-launching-downloaded-executable-content
[2] https://www.esentire.com/security-advisories/gootloader-hackers-poison-websites-globally

Join 100,000+ Security Leaders

Get notified when there's a new security advisory, and receive the latest news, intel and helpful tools & assets. You can unsubscribe anytime.

By clicking the button below I confirm that I have read and agree to the eSentire privacy policy.

View Most Recent Blogs