Malicious actors deploying Gootkit Loader on Australian Networks

Australian Cyber Security Centre

Background/ What has happened?

The ACSC has received an increase in reporting of malicious actors targeting Australian networks with Gootkit JavaScript (JS) Loaders. Gootkit JS Loaders are a precursor to several malware families traditionally used for cybercrime, notably, Gootkit, REvil ransomware, Kronos, or CobaltStrike.

How do I stay secure?

The ACSC has published an advisory about the risks, impacts and preventative actions associated with Gootkit JS Loaders on our website.

Assistance / Where can I go for help?

The ACSC is monitoring the situation and is able to provide assistance and advice as required.

Organisations that have observed similar behaviour, been impacted or require assistance can contact the ACSC via 1300 CYBER1 (1300 292 371).

/Public Release. This material from the originating organization/author(s) might be of the point-in-time nature, and edited for clarity, style and length. Mirage.News does not take institutional positions or sides, and all views, positions, and conclusions expressed herein are solely those of the author(s).View in full here.