Cybercriminals Targeting Law Firms with GootLoader and FakeUpdates Malware
Six
different
law
firms
were
targeted
in
January
and
February
2023
as
part
of
two
disparate
threat
campaigns
distributing
GootLoader
and
FakeUpdates
(aka
SocGholish)
malware
strains.
GootLoader,
active
since
late
2020,
is
a
first-stage
downloader
that’s
capable
of
delivering
a
wide
range
of
secondary
payloads
such
as
Cobalt
Strike
and
ransomware.
It
notably
employs
search
engine
optimization
(SEO)
poisoning
to
funnel
victims
searching
for
business-related
documents
toward
drive-by
download
sites
that
drop
the
JavaScript
malware.
In
the
campaign
detailed
by
cybersecurity
company
eSentire,
the
threat
actors
are
said
to
have
compromised
legitimate,
but
vulnerable,
WordPress
websites
and
added
new
blog
posts
without
the
owners’
knowledge.
“When
the
computer
user
navigates
to
one
of
these
malicious
web
pages
and
hits
the
link
to
download
the
purported
business
agreement,
they
are
unknowingly
downloading
GootLoader,”
eSentire
researcher
Keegan
Keplinger
said
in
January
2022.
The
disclosure
from
eSentire
is
the
latest
in
a
wave
of
attacks
that
have
utilized
the
Gootkit
malware
loader
to
breach
targets.
GootLoader
is
far
from
the
only
JavaScript
malware
targeting
business
professionals
and
law
firm
employees.
A
separate
set
of
attacks
have
also
entailed
the
use
of
SocGholish,
which
is
a
downloader
capable
of
dropping
more
executables.
The
infection
chain
is
further
significant
for
taking
advantage
of
a
website
frequented
by
legal
firms
as
a
watering
hole
to
distribute
the
malware.
Another
standout
aspect
of
the
twin
intrusion
sets
in
the
absence
of
ransomware
deployment,
instead
favoring
hands-on
activity,
suggesting
that
the
attacks
could
have
diversified
in
scope
to
include
espionage
operations.
“Prior
to
2021,
email
was
the
primary
infection
vector
used
by
opportunistic
threat
actors,”
Keplinger
said.
From
2021
to
2023,
browser-based
attacks
[…]
have
steadily
been
growing
to
compete
with
email
as
the
primary
infection
vector.”
“This
has
been
largely
thanks
to
GootLoader,
SocGholish,
SolarMarker,
and
recent
campaigns
leveraging
Google
Ads
to
float
top
search
results.”
About Author
