GootLoader, active since late 2020, is a first-stage downloader that’s capable of delivering a wide range of secondary payloads such as Cobalt Strike and ransomware.
In the campaign detailed by cybersecurity company eSentire, the threat actors are said to have compromised legitimate, but vulnerable, WordPress websites and added new blog posts without the owners’ knowledge.
“When the computer user navigates to one of these malicious web pages and hits the link to download the purported business agreement, they are unknowingly downloading GootLoader,” eSentire researcher Keegan Keplinger said in January 2022.
The disclosure from eSentire is the latest in a wave of attacks that have utilized the Gootkit malware loader to breach targets.
The infection chain is further significant for taking advantage of a website frequented by legal firms as a watering hole to distribute the malware.
Another standout aspect of the twin intrusion sets in the absence of ransomware deployment, instead favoring hands-on activity, suggesting that the attacks could have diversified in scope to include espionage operations.
“Prior to 2021, email was the primary infection vector used by opportunistic threat actors,” Keplinger said. From 2021 to 2023, browser-based attacks […] have steadily been growing to compete with email as the primary infection vector.”