LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0477: Goopy

Goopy is a Windows backdoor and Trojan used by APT32 and shares several similarities to another backdoor used by the group (Denis). Goopy is named for its impersonation of the legitimate Google Updater executable.[1]

EnterpriseS0477MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Goopy matters because it is a Windows backdoor/Trojan associated in ATT&CK with APT32 and designed to look like a legitimate Google Updater executable. For leaders, the practical issue is not a single malware name; it is whether Windows endpoints, egress controls, mailbox evidence, and SOC workflows can recognize a disguised backdoor that may collect local data, persist via scheduled tasks, communicate over common protocols, and impair defensive tools.

Executive priority

Prioritize this as a validation case for endpoint resilience and investigation readiness. The ATT&CK relationships tie Goopy to collection, discovery, persistence, command execution, command-and-control over web/mail/DNS protocols, exfiltration over C2, and stealth behaviors such as binary padding, junk code insertion, masquerading, DLL abuse, mailbox data clearing, and tool modification. Executives should ask whether the organization can prove coverage for these behaviors with auditable telemetry, not just malware signatures or hash blocklists.

Technical view

Goopy is a Windows malware object with no official ATT&CK detection text. Defensive validation should therefore be behavior-led. SOC and detection teams should test visibility around suspicious Google Updater-like filenames/locations, scheduled task creation or modification, cmd.exe and Visual Basic execution, DLL loading patterns, native API-heavy execution, local data access, user/process discovery, mailbox artifact changes, security tool tampering, and outbound C2-like traffic over HTTP/S, mail protocols, and DNS. Because related techniques include binary padding and junk code insertion, static signatures and hash-only controls should be treated as insufficient on their own.

Likely telemetry

  • Windows endpoint process creation and command-line logging, especially cmd.exe, Visual Basic-related execution, and discovery commands
  • Scheduled task creation, modification, and execution events
  • File creation, rename, path, signature, and parent-process telemetry for executables impersonating Google Updater
  • DLL load telemetry and abnormal DLL search/load behavior around suspicious executables
  • Endpoint file access telemetry for local data collection from user, configuration, database, or other sensitive locations

Detection direction

  • Do not rely only on hashes or static malware labels; the ATT&CK relationships include binary padding and junk code insertion, which can change file representation and complicate static analysis.
  • Baseline legitimate Google Update executable names, expected install paths, code-signing status, parent processes, and scheduled tasks; alert on close matches or unexpected locations without assuming every Google-like name is malicious.
  • Correlate weak signals: masqueraded executable plus scheduled task persistence, discovery activity, local file access, and outbound traffic over web/mail/DNS is more meaningful than any single event.
  • Tune scheduled task analytics for false positives from administrators and software updaters, but require justification for newly created tasks launching unusual binaries or scripts.
  • Validate mailbox audit coverage for deletion/export-style activity because the relationship set includes Clear Mailbox Data.

Mitigation priorities

  • Harden Windows endpoint execution controls with application control, trusted publisher validation, and restrictions on unapproved binaries in user-writable or unusual paths.
  • Govern scheduled task creation and review recurring tasks that execute scripts, command shells, or updater-like binaries outside expected vendor locations.
  • Strengthen endpoint logging, EDR health monitoring, and tamper protection so tool impairment is visible and recoverable.
  • Limit unnecessary outbound web, mail, and DNS paths; ensure egress monitoring can associate network activity with endpoint processes where possible.
  • Protect mailbox audit logs and retention so mailbox data clearing can be investigated after the fact.
Additional notes and limits

This take is based on ATT&CK S0477 Goopy, its official description, the Cybereason Cobalt Kitty reference, and supplied ATT&CK relationships. The relationship to APT32 is useful for threat intelligence context, but local evidence is required before making attribution or exposure claims. The strongest defensive value is using Goopy as a behavior-based coverage test across Windows endpoint, network, mailbox, and security-tool telemetry.

ATT&CK provides no official detection text for Goopy in the supplied object, and the object-level tactics are not specified. The guidance above is derived from the supplied technique relationships and should be validated against the organization’s actual Windows estate, logging depth, security tooling, and legitimate Google Update behavior.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Goopy

Goopy is a Windows backdoor and Trojan used by APT32 and shares several similarities to another backdoor used by the group (Denis). Goopy is named for its impersonation of the legitimate Google Updater executable.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
EnterpriseT1071.004DNSSub-technique

Goopy has the ability to communicate with its C2 over DNS.[1]

EnterpriseT1059.005Visual BasicSub-technique

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.[1]

EnterpriseT1027.016Junk Code InsertionSub-technique

Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.[1]

EnterpriseT1685Disable or Modify Tools

Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.[1]

EnterpriseT1033System Owner/User Discovery

Goopy has the ability to enumerate the infected system's user name.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Goopy has the ability to communicate with its C2 over HTTP.[1]

EnterpriseT1057Process Discovery

Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.[1]

EnterpriseT1070.008Clear Mailbox DataSub-technique

Goopy has the ability to delete emails used for C2 once the content has been copied.[1]

EnterpriseT1005Data from Local System

Goopy has the ability to exfiltrate documents from infected systems.[1]

EnterpriseT1106Native API

Goopy has the ability to enumerate the infected system's user name via GetUserNameW.[1]

EnterpriseT1071.003Mail ProtocolsSub-technique

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Goopy has used a polymorphic decryptor to decrypt itself at runtime.[1]

EnterpriseT1574.001DLLSub-technique

Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.[1]

EnterpriseT1027.001Binary PaddingSub-technique

Goopy has had null characters padded in its malicious DLL payload.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0050: APT32

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1071.004: DNSEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1027.016: Junk Code InsertionEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1070.008: Clear Mailbox DataEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1071.003: Mail ProtocolsEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · GroupG0050: APT32Enterpriseuses · TechniqueT1027.001: Binary PaddingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
79483051a47b4d29...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle79483051a47b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  2. [2]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  3. [3]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  4. [4]
    mitre-attackS0477
    Open source URL
  5. [5]
    mitre-attackS0477
    Open source URL
  6. [6]
    mitre-attackS0477
    Open source URL
  7. [7]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  8. [8]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  9. [9]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  10. [10]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  11. [11]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  12. [12]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  13. [13]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  14. [14]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  15. [15]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  16. [16]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  17. [17]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  18. [18]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  19. [19]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  20. [20]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  21. [21]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  22. [22]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  23. [23]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  24. [24]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  25. [25]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  26. [26]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  27. [27]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  28. [28]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  29. [29]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  30. [30]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  31. [31]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  32. [32]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  33. [33]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  34. [34]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  35. [35]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  36. [36]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  37. [37]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  38. [38]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  39. [39]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use