GootLoader Hackers Targeting Employees of Law and Accounting Firms

Operators of the GootLoader campaign are setting their sights on
employees of accounting and law firms as part of a fresh onslaught
of widespread cyberattacks to deploy malware on infected systems,
an indication that the adversary is expanding its focus to other
high-value targets.

“GootLoader is a stealthy initial access malware, which after
getting a foothold into the victim’s computer system, infects the
system with ransomware or other lethal malware,” researchers from
eSentire said^[1]
in a report shared with The Hacker News.

The cybersecurity services provider said it intercepted and
dismantled intrusions aimed at three law firms and an accounting
enterprise. The names of the victims were not disclosed.

Malware can be delivered on targets’ systems via many methods,
including poisoned search results, fake updates, and trojanized
applications downloaded from sites linking to pirated software.
GootLoader resorts to the first technique.

In March 2021, details emerged^[2]
of a global drive-by download^[3]
offensive that involved tricking unsuspecting victims into visiting
compromised WordPress websites belonging to legitimate businesses
via a technique called search engine poisoning that pushes these
sites to the top of the search results.

“Their modus operandi (MO) is to entice a business professional
to one of the compromised websites and then have them click on the
link, leading to Gootloader, which attempts to retrieve the final
payload, whether it be ransomware, a banking trojan or intrusion
tool/credential stealer,” the researchers explained^[4]
in a write-up.

eSentire estimates that over 100,000 malicious webpages were set
up last year across websites representing entities in the hotel
industry, high-end retail, education, healthcare, music and visual
arts, with one of the hacked websites hosting 150 rogue pages
designed to social engineer users searching for postnuptial or
intellectual property agreements.

The websites, for their part, are broken into by exploiting
security vulnerabilities in the WordPress content management system
(CMS^[5]), effectively permitting
the attackers to clandestinely inject the pages of their liking
without the website owner’s knowledge.

The nature of GootLoader and the way it’s designed to provide a
backdoor into systems implies that the goal of the attacks could be
intelligence gathering, but it could also be utilised as a tool for
delivering additional damaging payloads, including Cobalt Strike
and ransomware, to compromised systems for follow-on attacks.

“GootLoader relies heavily on social engineering to establish
its foothold, from poisoning Google search results to fashioning
the payload,” said Keegan Keplinger, research and reporting lead
for eSentire’s Threat Response Unit (TRU).

“GootLoader’s operators invite employees to seek, download, and
execute their malware under the guise of a free business agreement
template. This is particularly effective against legal firms, who
may encounter uncommon requests from clients.”

To mitigate such threats, it’s recommended that organizations
put in place a vetting process for business agreement samples,
train employees to open documents only from trusted sources, and
ensure that the content downloaded matches the content intended to
be downloaded.