Connect with us

Hi, what are you looking for?



Recent GootLoader Campaign Targets Law, Accounting Firms

A recently observed GootLoader campaign has been focusing on infecting the devices of legal and accounting company employees with malware, eSentire reports.

A recently observed GootLoader campaign has been focusing on infecting the devices of legal and accounting company employees with malware, eSentire reports.

Initially detailed in December 2020, GootLoader is a piece of initial access malware, allowing its operators to deploy various other malware families – including ransomware – on the compromised machines.

Over the past few weeks, the GootLoader hacking group has focused mainly on targeting individuals at law and accounting firms, with the most recent attack observed on January 6. eSentire says it has intercepted three such attacks so far.

Potential victims are lured to compromised legitimate websites containing hundreds of pages of business-specific content – including free samples of documents for download – where they end up infected with GootLoader instead.

The compromised websites – which use WordPress as their content management system (CMS) – belong to organizations in a variety of industries, such as education, healthcare, hospitality, retail, and entertainment, among others.

“With the volume of content the threat actors have populated onto the web, when a professional goes onto Google searching for a sample business agreement, the hackers’ malicious web pages come up in the top Google searches,” said eSentire researcher Keegan Keplinger.

When the victim navigates to one of the malicious pages and downloads a sample document, they actually download GootLoader, which could then lead to an infection with ransomware or other malware.

Related: Eight New macOS Malware Families Emerged in 2021

Advertisement. Scroll to continue reading.

Related: Zloader Banking Malware Exploits Microsoft Signature Verification

Related: Microsoft Office Patch Bypassed for Malware Distribution in Apparent ‘Dry Run’

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...