A recently observed GootLoader campaign has been focusing on infecting the devices of legal and accounting company employees with malware, eSentire reports.
Initially detailed in December 2020, GootLoader is a piece of initial access malware, allowing its operators to deploy various other malware families – including ransomware – on the compromised machines.
Over the past few weeks, the GootLoader hacking group has focused mainly on targeting individuals at law and accounting firms, with the most recent attack observed on January 6. eSentire says it has intercepted three such attacks so far.
Potential victims are lured to compromised legitimate websites containing hundreds of pages of business-specific content – including free samples of documents for download – where they end up infected with GootLoader instead.
The compromised websites – which use WordPress as their content management system (CMS) – belong to organizations in a variety of industries, such as education, healthcare, hospitality, retail, and entertainment, among others.
“With the volume of content the threat actors have populated onto the web, when a professional goes onto Google searching for a sample business agreement, the hackers’ malicious web pages come up in the top Google searches,” said eSentire researcher Keegan Keplinger.
When the victim navigates to one of the malicious pages and downloads a sample document, they actually download GootLoader, which could then lead to an infection with ransomware or other malware.
Related: Eight New macOS Malware Families Emerged in 2021
Related: Zloader Banking Malware Exploits Microsoft Signature Verification
Related: Microsoft Office Patch Bypassed for Malware Distribution in Apparent ‘Dry Run’
