Cybercriminals Targeting Law Firms with GootLoader and FakeUpdates Malware : Six different law firms were targeted in January and February 2023 as part of two disparate threat campaigns distributingGootLoaderandFakeUpdates(aka SocGholish) malware strains.
GootLoader, active since late 2020, is a first-stage downloader that’s capable of delivering a wide range of secondary payloads such as Cobalt Strike and ransomware.
It notablyemployssearch engine optimization (SEO) poisoning to funnel victims searching for business-related documents toward drive-by download sites that drop the JavaScript malware.
In thecampaigndetailed by cybersecurity company eSentire, the threat actors are said to have compromised legitimate, but vulnerable, WordPress websites and added new blog posts without the owners’ knowledge.
Also read : Cyber Physical Systems for Smart Grid Applications
“When the computer user navigates to one of these malicious web pages and hits the link to download the purported business agreement, they are unknowingly downloading GootLoader,” eSentire researcher Keegan Keplingersaidin January 2022.
The disclosure from eSentire is the latest in a wave of attacks that have utilized the Gootkit malware loader to breach targets.
GootLoader is far from the only JavaScript malware targeting business professionals and law firm employees. A separate set of attacks have also entailed the use ofSocGholish, which is a downloader capable of dropping more executables.
The infection chain is further significant for taking advantage of a website frequented by legal firms as awatering holeto distribute the malware.
Another standout aspect of the twin intrusion sets in the absence of ransomware deployment, instead favoring hands-on activity, suggesting that the attacks could have diversified in scope to include espionage operations.
“Prior to 2021, email was the primary infection vector used by opportunistic threat actors,” Keplinger said. From 2021 to 2023, browser-based attacks […] have steadily been growing to compete with email as the primary infection vector.”
“This has been largely thanks to GootLoader, SocGholish,SolarMarker, and recent campaignsleveraging Google Adsto float top search results.”
Also read : What is Deepfake, and how does it Affect Cybersecurity?