# Gootloader | Threat Detection Overview

Gootloader abuses WordPress /wp-comments-post.php to serve XOR-encrypted ZIP payloads, using WOFF2 glyph-swapped fonts to hide filenames, leading to domain controller compromise in 17 hours.

- Payout: Real-world hack
- Severity: critical
- Program: WordPress
- Analysis by: Huntress
- Disclosed: 2025-11-05
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation
- Tags: area:os domain:desktop domain:web impact:data-leak impact:privesc impact:rce kind:incident platform:threat-intel sev:critical tech:windows tech:wordpress technique:reverse-engineering technique:source-review vuln:misconfiguration

**Target:** WordPress /wp-comments-post.php comment submission endpoint on compromised sites
**Root cause:** Compromised WordPress sites' comment submission endpoint is abused to return XOR-encrypted ZIP archives keyed by the requested comment_post_ID, with filenames obfuscated via a custom WOFF2 font whose glyph vector paths are swapped so source gibberish renders as readable filenames.
**Steps:**
1. Victim searches Bing for e.g. 'missouri cover utility easement roadway' and lands on a compromised WordPress site via SEO poisoning.
2. Page loads malicious JS masquerading as jQuery v3.0.0 with obfuscated string fragments reassembled into second-stage JS.
3. User clicks 'Download' next to one of five payloads; JS sends `POST /wp-comments-post.php` with `comment_post_ID={document_id}`.
4. Server returns XOR-encrypted ZIP; XOR key is hardcoded in page source and equals the selected payload filename with extension (e.g. `Missouri_Utility_Easement_Guide_2023.pdf`), unique per payload.
5. Filenames in source are gibberish (e.g. `Oa9Z±h•`) rendered as readable text via embedded WOFF2 font (Z85-encoded, ~40K) with swapped glyph vector paths.
6. Extracted ZIP drops JS; VBScript wrapper checks WScript.FullName for wscript.exe/cscript.exe, then launches "powershell & powershell".
7. PowerShell exfiltrates env vars ≤99 chars, OS caption, GUI process window titles (26th CSV field), desktop files, and drives >50KB free; each output GZip+Base64 with 6-byte header [235,154,216,67,95,5] and footer [5,135,37,102,109,114].
8. Beacon randomly picks one of 10 C2 domains via Get-Random, loops every 20s via AutoResetEvent, executes received PowerShell commands.
9. 10-20 min later, Startup folder persistence drops .lnk files (e.g. `molecular ecology.lnk`) referencing targets via 8.3 short names (MOLECU1.LNK, EMCCON1.JS) with hotkeys CTRL+ALT+M / CTRL+ALT+G.
10. Supper SOCKS5 backdoor dropped (4 instances in Case #1); recon within 20 min: `net user /domain`, `nltest /dclist:`, `net group "domain admins" /domain`, SPN scans, Kerberoasting.
11. ~17h later lateral movement via WinRM to DC; create `sccmad` via `net USER sccmad <pw> /ADD`, add to Domain Admins and local Administrators, `quser.exe`.
12. Impacket executes `vssadmin list shadows /for=C:` via execute.bat to enumerate shadow copies before ransomware staging.
**How found:** Huntress observed three Gootloader infections since Oct 27 and reverse-engineered the infection chain: deobfuscated the jQuery-masquerading JS, noticed gibberish filenames rendering as readable text, identified the embedded Z85-encoded WOFF2 font with swapped glyph paths, and extracted the XOR key logic and C2 domains from the second-stage PowerShell.
**Exploitation:** SEO-poisoned compromised WordPress sites lure victims searching for document templates; clicking Download triggers a POST to /wp-comments-post.php returning an XOR-encrypted ZIP whose key is the payload filename. Extracted JS runs PowerShell recon, beacons to rotating C2 domains, and drops Startup-folder LNK persistence plus Supper SOCKS5 backdoors. Operators then perform AD recon, Kerberoast, WinRM lateral movement, create Domain Admin accounts, ntdsutil dump, and enumerate shadow copies for Rhysida ransomware deployment.
**Escalation:** Initial JS execution → Supper backdoor → AD enumeration/Kerberoasting → WinRM to DC → Domain Admin creation → DCSync/NTDS.dit dump and VSS enumeration, enabling ransomware; DC compromise in as little as 17 hours (under 1 hour in DFIRReport case).
**Insight:** When source strings look like gibberish but render readable in-browser, check for embedded custom fonts (Z85/Base85 blobs) with swapped glyph vector paths—keyword string searches will miss the payload entirely; also check /wp-comments-post.php responses on compromised WordPress sites for XOR-encrypted ZIPs keyed by comment_post_ID.

## Proof of concept (copied exactly from the original report)

**Supper backdoor execution command line**

```
C:\Users\username\AppData\Local\Zoxsimio\Failover Dependency.exe" ./FAILOV~1.ULB ,DllRegisterServer.
```

**Domain Admin creation and VSS enumeration via Impacket**

```
net USER sccmad <redacted password> /ADD
 
- net group \"Domain Admins\" sccmad /ADD /DOMAIN
 
- net LOCALGROUP administrators sccmad /add
 
- quser.exe

The threat actor then leveraged Impacket to remotely execute the following command on the Domain Controller:

- cmd.exe /Q /c echo C:\Windows\system32\cmd.exe /C vssadmin list shadows /for=C: ^> C:\Windows\Temp\__output > C:\Windows\TEMP\execute.bat & C:\Windows\system32\cmd.exe /Q /c C:\Windows\TEMP\execute.bat & del C:\Windows\TEMP\execute.bat
```

**Self-delete command with ping delay**

```
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "<path>"
```