Mar 01, 2023Ravie LakshmananThreat Intelligence / Malware
Six different law firms were targeted in January and February 2023 as part of two disparate threat campaigns distributing GootLoader and FakeUpdates (aka SocGholish) malware strains.
GootLoader, active since late 2020, is a first-stage downloader that’s capable of delivering a wide range of secondary payloads such as Cobalt Strike and ransomware.
It notably employs search engine optimization (SEO) poisoning to funnel victims searching for business-related documents toward drive-by download sites that drop the JavaScript malware.
In the campaign detailed by cybersecurity company eSentire, the threat actors are said to have compromised legitimate, but vulnerable, WordPress websites and added new blog posts without the owners’ knowledge.
“When the computer user navigates to one of these malicious web pages and hits the link to download the purported business agreement, they are unknowingly downloading GootLoader,” eSentire researcher Keegan Keplinger said in January 2022.
The disclosure from eSentire is the latest in a wave of attacks that have utilized the Gootkit malware loader to breach targets.
GootLoader is far from the only JavaScript malware targeting business professionals and law firm employees. A second set of attacks also entailed the use of SocGholish, which is a downloader capable of dropping more executables.
The infection chain is further significant for taking advantage of a website frequented by legal firms as a watering hole to distribute the malware under the guise of fake browser updates.
Discover the Latest Malware Evasion Tactics and Prevention Strategies
Ready to bust the 9 most dangerous myths about file-based attacks? Join our upcoming webinar and become a hero in the fight against patient zero infections and zero-day security events!
Another standout aspect of the twin intrusion sets in the absence of ransomware deployment, instead favoring hands-on activity, suggesting that the attacks could have diversified in scope to include espionage operations.
“Prior to 2021, email was the primary infection vector used by opportunistic threat actors,” Keplinger said. From 2021 to 2023, browser-based attacks […] have steadily been growing to compete with email as the primary infection vector.”
“This has been largely thanks to GootLoader, SocGholish, SolarMarker, and recent campaigns leveraging Google Ads to float top search results.”
Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.
