Check out our new blog about GOOTLOADER and notable changes to the TTPs by #UNC2565. We are covering the various methods used by the malware to obscure its code, as well as provide scripts that can automate the deobfuscation process.
#GOOTLOADER#Mandiantmandiant.com/resources/blog…
@NinjaParanoid Our web filter at work somehow still works with this enabled. I'm really curious how. By IP? But seems like a dying way with there no longer being a 1:1 relationship between domain names and IPs.