Connect with us

Hi, what are you looking for?



Recent GootLoader Campaign Targets Law, Accounting Firms

A recently observed GootLoader campaign has been focusing on infecting the devices of legal and accounting company employees with malware, eSentire reports.

A recently observed GootLoader campaign has been focusing on infecting the devices of legal and accounting company employees with malware, eSentire reports.

Initially detailed in December 2020, GootLoader is a piece of initial access malware, allowing its operators to deploy various other malware families – including ransomware – on the compromised machines.

Over the past few weeks, the GootLoader hacking group has focused mainly on targeting individuals at law and accounting firms, with the most recent attack observed on January 6. eSentire says it has intercepted three such attacks so far.

Potential victims are lured to compromised legitimate websites containing hundreds of pages of business-specific content – including free samples of documents for download – where they end up infected with GootLoader instead.

The compromised websites – which use WordPress as their content management system (CMS) – belong to organizations in a variety of industries, such as education, healthcare, hospitality, retail, and entertainment, among others.

“With the volume of content the threat actors have populated onto the web, when a professional goes onto Google searching for a sample business agreement, the hackers’ malicious web pages come up in the top Google searches,” said eSentire researcher Keegan Keplinger.

When the victim navigates to one of the malicious pages and downloads a sample document, they actually download GootLoader, which could then lead to an infection with ransomware or other malware.

Advertisement. Scroll to continue reading.

Related: Eight New macOS Malware Families Emerged in 2021

Related: Zloader Banking Malware Exploits Microsoft Signature Verification

Related: Microsoft Office Patch Bypassed for Malware Distribution in Apparent ‘Dry Run’

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Artificial Intelligence

The degree of danger that may be introduced when adversaries start to use AI as an effective weapon of attack rather than a tool...