"The threat actors have recently resorted to utilizing JSON storage services like JSON Keeper, JSONsilo, and npoint.io to ...
Huntress finds three GootLoader infections since Oct 27, 2025; two led to domain controller compromise within 17 hours.