Operators of the GootLoader campaign have been seen specifically targeting employees of accounting and law firms this year, marking a shift in their focus of targets. The Gootloader payload is the initial access malware used to compromise a system in these campaigns, with other lethal malware, like ransomware, to follow.
GootLoader uses poisoned search results in search engines to lure their target into downloading the GootLoader malware. The GootLoader operators utilize compromised WordPress sites to host their malware that is masquerading as sample business agreements or templates the targeted victims may be interested in viewing. When the victim performs a search for these types of business agreements, they end up accessing the compromised WordPress site due to it being one of the top results returned by the search engine. The fake business agreement hosted on these sites is actually a JavaScript file that, when executed, downloads further malware on to the system. Samples of GootLoader show that next step payloads may be a flavor of ransomware, the Gootkit banking trojan, or a Cobalt Strike beacon.
The WordPress sites that the GootLoader operators have compromised have been seen being broken into by exploiting security vulnerabilities in unpatched or older versions of the software.
