Share news article

Share on facebook
Share on twitter
Share on linkedin
Share on email

Gootkit Malware Adopts New Tactics to Attack Healthcare and Finance Firms

Feb 09, 2023Ravie LakshmananThreat Intelligence / Malware

The Gootkit malware is prominently going after healthcare and finance organizations in the U.S., U.K., and Australia, according to new findings from Cybereason.

The cybersecurity firm said it investigated a Gootkit incident in December 2022 that adopted a new method of deployment, with the actors abusing the foothold to deliver Cobalt Strike and SystemBC for post-exploitation.

“The threat actor displayed fast-moving behaviors, quickly heading to control the network it infected, and getting elevated privileges in less than four hours,” Cybereason said in an analysis published February 8, 2023.

Gootkit, also called Gootloader, is exclusively attributed to a threat actor tracked by Mandiant as UNC2565. Starting its life in 2014 as a banking trojan, the malware has since morphed into a loader capable of delivering next-stage payloads.

The shift in tactics was first uncovered by Sophos in March 2021. Gootloader takes the form of heavily-obfuscated JavaScript files that are served through compromised WordPress sites ranked higher in search engine results through poisoning techniques.

The attack chain relies on luring victims searching for agreements and contracts on DuckDuckGo and Google to the booby-trapped web page, ultimately leading to the deployment of Gootloader.

The latest wave is also notable for concealing the malicious code within legitimate JavaScript libraries such as jQuery, Chroma.js, Sizzle.js, and Underscore.js, which is then used to spawn a secondary 40 MB JavaScript payload that establishes persistence and launches the malware.

In the incident examined by Cybereason, the Gootloader infection is said to have paved the way for Cobalt Strike and SystemBC to conduct lateral movement and possible data exfiltration. The attack was ultimately foiled.

The disclosure comes amid the ongoing trend of abusing Google Ads by malware operators as an intrusion vector to distribute a variety of malware such as FormBook, IcedID, RedLine, Rhadamanthys, and Vidar.

The evolution of Gootloader into a sophisticated loader is further reflective of how threat actors are constantly seeking new targets and methods to maximize their profits by pivoting to a malware-as-a-service (MaaS) model and selling that access to other criminals.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Related News

Researcher create polymorphic Blackmamba malware with ChatGPT

Researcher create polymorphic Blackmamba malware with ChatGPT

The malware can target Windows, macOS and Linux devices. HYAS Institute researcher and cybersecurity expert, Jeff Sims, has developed a…
Owner of Breach Forums Pompompurin Arrested in New York

Owner of Breach Forums Pompompurin Arrested in New York

Pompompurin has been charged with a single count of conspiracy to commit access device fraud. Conor Brian Fitzpatrick (aka Pompompurin,…
New Vishing Attack Spreading FakeCalls Android Malware

New Vishing Attack Spreading FakeCalls Android Malware

The attack scheme begins with the FakeCalls malware masquerading as an online banking application of a reputable South Korean financial…