Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Recent GootLoader Campaign Targets Law, Accounting Firms

A recently observed GootLoader campaign has been focusing on infecting the devices of legal and accounting company employees with malware, eSentire reports.

A recently observed GootLoader campaign has been focusing on infecting the devices of legal and accounting company employees with malware, eSentire reports.

Initially detailed in December 2020, GootLoader is a piece of initial access malware, allowing its operators to deploy various other malware families – including ransomware – on the compromised machines.

Over the past few weeks, the GootLoader hacking group has focused mainly on targeting individuals at law and accounting firms, with the most recent attack observed on January 6. eSentire says it has intercepted three such attacks so far.

Potential victims are lured to compromised legitimate websites containing hundreds of pages of business-specific content – including free samples of documents for download – where they end up infected with GootLoader instead.

The compromised websites – which use WordPress as their content management system (CMS) – belong to organizations in a variety of industries, such as education, healthcare, hospitality, retail, and entertainment, among others.

“With the volume of content the threat actors have populated onto the web, when a professional goes onto Google searching for a sample business agreement, the hackers’ malicious web pages come up in the top Google searches,” said eSentire researcher Keegan Keplinger.

When the victim navigates to one of the malicious pages and downloads a sample document, they actually download GootLoader, which could then lead to an infection with ransomware or other malware.

Related: Eight New macOS Malware Families Emerged in 2021

Advertisement. Scroll to continue reading.

Related: Zloader Banking Malware Exploits Microsoft Signature Verification

Related: Microsoft Office Patch Bypassed for Malware Distribution in Apparent ‘Dry Run’

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

SaaS security company AppOmni has hired Joel Wallenstrom as its General Manager.

FTI Consulting has appointed Brett Callow as Managing Director in its Cybersecurity & Data Privacy Communications practice.

Mobile security firm Zimperium has welcomed David Natker as its VP of Global Partners and Alliances.

More People On The Move

Expert Insights