S0477: Goopy
MITRE ATT&CK S0477: Goopy Malware details for Windows, with detection guidance, relationships and mapped CVEs.
Security context for executives and security teams
Goopy matters because it is a Windows backdoor/Trojan associated in ATT&CK with APT32 and designed to look like a legitimate Google Updater executable. For leaders, the practical issue is not a single malware name; it is whether Windows endpoints, egress controls, mailbox evidence, and SOC workflows can recognize a disguised backdoor that may collect local data, persist via scheduled tasks, communicate over common protocols, and impair defensive tools.
Executive priority
Prioritize this as a validation case for endpoint resilience and investigation readiness. The ATT&CK relationships tie Goopy to collection, discovery, persistence, command execution, command-and-control over web/mail/DNS protocols, exfiltration over C2, and stealth behaviors such as binary padding, junk code insertion, masquerading, DLL abuse, mailbox data clearing, and tool modification. Executives should ask whether the organization can prove coverage for these behaviors with auditable telemetry, not just malware signatures or hash blocklists.
Technical view
Goopy is a Windows malware object with no official ATT&CK detection text. Defensive validation should therefore be behavior-led. SOC and detection teams should test visibility around suspicious Google Updater-like filenames/locations, scheduled task creation or modification, cmd.exe and Visual Basic execution, DLL loading patterns, native API-heavy execution, local data access, user/process discovery, mailbox artifact changes, security tool tampering, and outbound C2-like traffic over HTTP/S, mail protocols, and DNS. Because related techniques include binary padding and junk code insertion, static signatures and hash-only controls should be treated as insufficient on their own.
Likely telemetry
- Windows endpoint process creation and command-line logging, especially cmd.exe, Visual Basic-related execution, and discovery commands
- Scheduled task creation, modification, and execution events
- File creation, rename, path, signature, and parent-process telemetry for executables impersonating Google Updater
- DLL load telemetry and abnormal DLL search/load behavior around suspicious executables
- Endpoint file access telemetry for local data collection from user, configuration, database, or other sensitive locations
Detection direction
- Do not rely only on hashes or static malware labels; the ATT&CK relationships include binary padding and junk code insertion, which can change file representation and complicate static analysis.
- Baseline legitimate Google Update executable names, expected install paths, code-signing status, parent processes, and scheduled tasks; alert on close matches or unexpected locations without assuming every Google-like name is malicious.
- Correlate weak signals: masqueraded executable plus scheduled task persistence, discovery activity, local file access, and outbound traffic over web/mail/DNS is more meaningful than any single event.
- Tune scheduled task analytics for false positives from administrators and software updaters, but require justification for newly created tasks launching unusual binaries or scripts.
- Validate mailbox audit coverage for deletion/export-style activity because the relationship set includes Clear Mailbox Data.
Mitigation priorities
- Harden Windows endpoint execution controls with application control, trusted publisher validation, and restrictions on unapproved binaries in user-writable or unusual paths.
- Govern scheduled task creation and review recurring tasks that execute scripts, command shells, or updater-like binaries outside expected vendor locations.
- Strengthen endpoint logging, EDR health monitoring, and tamper protection so tool impairment is visible and recoverable.
- Limit unnecessary outbound web, mail, and DNS paths; ensure egress monitoring can associate network activity with endpoint processes where possible.
- Protect mailbox audit logs and retention so mailbox data clearing can be investigated after the fact.
Additional notes and limits
This take is based on ATT&CK S0477 Goopy, its official description, the Cybereason Cobalt Kitty reference, and supplied ATT&CK relationships. The relationship to APT32 is useful for threat intelligence context, but local evidence is required before making attribution or exposure claims. The strongest defensive value is using Goopy as a behavior-based coverage test across Windows endpoint, network, mailbox, and security-tool telemetry.
ATT&CK provides no official detection text for Goopy in the supplied object, and the object-level tactics are not specified. The guidance above is derived from the supplied technique relationships and should be validated against the organization’s actual Windows estate, logging depth, security tooling, and legitimate Google Update behavior.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Goopy
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.