Gootkit Loader Resurfaces with Updated Tactic to Compromise Targeted Computers

guest · Aug 1, 2022

July 31, 2022

The operators of the Gootkit access-as-a-service (AaaS) malware have resurfaced with updated techniques to compromise unsuspecting victims.

"In the past, Gootkit used freeware installers to mask malicious files; now it uses legal documents to trick users into downloading these files," Trend Micro researchers Buddy Tancio and Jed Valderama said in a write-up last week.
The findings build on a previous report from eSentire, which disclosed in January of widespread attacks aimed at employees of accounting and law firms to deploy malware on infected systems.
Click to expand...

Gootkit is part of the proliferating underground ecosystem of access brokers, who are known to provide other malicious actors a pathway into corporate networks for a price, paving the way for actual damaging attacks such as ransomware.

The loader utilizes malicious search engine results, a technique called SEO poisoning, to lure unsuspecting users into visiting compromised websites hosting malware-laced ZIP package files purportedly related to disclosure agreements for real estate transactions.

"The combination of SEO poisoning and compromised legitimate websites can mask indicators of malicious activity that would usually keep users on their guard," the researchers pointed out.
Click to expand...

"Gootkit is still active and improving its techniques," the researchers said. "This implies that this operation has proven effective, as other threat actors seem to continue using it."
Click to expand...

Trend Micro: Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike

Gootkit has been known to use fileless techniques to drop Cobalt Strike and other malicious payloads. Insights from a recent attack reveal updates in its tactics.
Click to expand...

guest · Jan 11, 2023

Australian Healthcare Sector Targeted in Latest Gootkit Malware Attacks
By Ravie Lakshmanan - January 11, 2023

A wave of Gootkit malware loader attacks has targeted the Australian healthcare sector by leveraging legitimate tools like VLC Media Player.
Click to expand...

Gootkit, also called Gootloader, is known to employ search engine optimization (SEO) poisoning tactics (aka spamdexing) for initial access. It typically works by compromising and abusing legitimate infrastructure and seeding those sites with common keywords.

Like other malware of its kind, Gootkit is capable of stealing data from the browser, performing adversary-in-the-browser (AitB) attacks, keylogging, taking screenshots, and other malicious actions.
Click to expand...

Trend Micro's new findings reveal that the keywords "hospital," "health," "medical," and "enterprise agreement" have been paired with various city names in Australia, marking an malware's expansion beyond accounting and law firms.

"Upon accessing the site, the user is presented with a screen that has been made to look like a legitimate forum," Trend Micro researchers said. "Users are led to access the link so that the malicious ZIP file can be downloaded."
What's more, the JavaScript code that's used to pull off this trickery is injected into a valid JavaScript file at random sections on the breached website.
Click to expand...

Once the wait time elapses, two additional payloads are dropped – msdtc.exe and libvlc.dll – the former of which is a legitimate VLC Media Player binary that's used to load the Cobalt Strike DLL component, followed by downloading more tools to facilitate discovery.

"The malicious actors behind [Gootkit] are actively implementing their campaign," the researchers said. "The threats targeting specific job sectors, industries, and geographic areas are becoming more aggressive."
Click to expand...

Trend Micro: Gootkit Loader Actively Targets Australian Healthcare Industry

By Hitomi Kimura, Ryan Maglaque, Fe Cureg, Trent Bessell - January 9, 2023
We analyzed the infection routine used in recent Gootkit loader attacks on the Australian healthcare industry and found that Gootkit leveraged SEO poisoning for its initial access and abused legitimate tools like VLC Media Player.
Click to expand...

guest · Jan 29, 2023

Gootkit Malware Continues to Evolve with New Components and Obfuscations
By Ravie Lakshmanan - January 29, 2023

The threat actors associated with the Gootkit malware have made "notable changes" to their toolset, adding new components and obfuscations to their infection chains.
Click to expand...

Google-owned Mandiant is monitoring the activity cluster under the moniker UNC2565, noting that the usage of the malware is "exclusive to this group."

Gootkit, also called Gootloader, is spread through compromised websites that victims are tricked into visiting when searching for business-related documents like agreements and contracts via a technique called search engine optimization (SEO) poisoning.
The purported documents take the form of ZIP archives that harbor the JavaScript malware, which, when launched, paves the way for additional payloads such as Cobalt Strike Beacon, FONELAUNCH, and SNOWCONE.
Click to expand...

It's not just Gootkit, as three different flavors of FONELAUNCH – FONELAUNCH.FAX, FONELAUNCH.PHONE, and FONELAUNCH.DIALTONE – have been put to use by UNC2565 since May 2021 to execute DLLs, .NET binaries, and PE files, indicating that the malware arsenal is being continuously maintained and updated.

"These changes are illustrative of UNC2565's active development and growth in capabilities," Mandiant researchers Govand Sinjari and Andy Morales said.
Click to expand...

Mandiant: Welcome to Goot Camp: Tracking the Evolution of GOOTLOADER Operations

By Govand Sinjari, Andy Morales - January 26, 2023
Since January 2021, Mandiant Managed Defense has consistently responded to GOOTLOADER infections. Threat actors cast a widespread net when spreading GOOTLOADER and impact a wide range of industry verticals and geographic regions. We currently only attribute GOOTLOADER malware and infrastructure to a group we track as UNC2565, and we believe it to be exclusive to this group.

Beginning in 2022, UNC2565 began incorporating notable changes to the tactics, techniques, and procedures (TTPs) used in its operations. These changes include the use of multiple variations of the FONELAUNCH launcher, the distribution of new follow-on payloads, and changes to the GOOTLOADER downloader and infection chain, including the introduction of GOOTLOADER.POWERSHELL. These changes are illustrative of UNC2565’s active development and growth in capabilities.
Click to expand...

guest · Feb 8, 2023

A Deep Dive Into the Growing GootLoader Threat
By Kevin Townsend - February 8, 2023

GootLoader was born from GootKit, a banking trojan that first appeared around 2014. In recent years GootKit has evolved into a sophisticated and evasive loader — and it was given a new name to reflect its new purpose in 2021. The same group is responsible for both versions of the malware, and is monitored by Mandiant as UNC2565.
Click to expand...

The evolution of GootLoader reflects the evolution of cybercriminal gangs. Many of the more sophisticated gangs are switching to a malware-as-a-service business model.

They develop the malware, but less-advanced gangs or individuals pay for use of that malware. In this case, it is access (or victim) as a service. GootLoader provides access to victims primarily for ransomware.
Click to expand...

GootLoader continues to evolve. Researchers at Cybereason have published a deep dive into the latest version.

The infection journey starts within compromised WordPress sites. These sites are given greater validity through SEO poisoning techniques, with key words likely hidden within html code on valid pages. Google Ads may also be used. With a high search engine ranking, potential victims are more likely to visit the compromised site.
If a victim is drawn into a watering hole WordPress site, he is provided with a ZIP file containing a malicious JavaScript. This is described as stage-1 of the GootLoader infection.
It also generates a second JavaScript file (stage-2 of the infection) which is 40 MB in size (random junk code is added, probably to confuse and evade detection).
Click to expand...

Cybereason assesses the GootLoader threat level as ‘severe’. The malware uses a combination of evasion and living off the land techniques, and its presence is unlikely to be spotted by anything other than AI-assisted anomaly detection.
Click to expand...

Cybereason: THREAT ALERT: GootLoader - SEO Poisoning and Large Payloads Leading to Compromise

February 8, 2023
KEY DETAILS
• GootLoader has security evasion in mind: Cybereason IR team observed large payloads (40MB and more) masquerading with legitimate JavaScript code, in order to evade security mechanisms.
• Aggressive threat actor: The threat actor displayed fast-moving behaviors, quickly heading to control the network it infected, and getting elevated privileges in less than 4 hours.
• Deployment of additional C2 frameworks: Cybereason IR team observed post-infection frameworks being deployed: Cobalt Strike and SystemBC, which is usually leveraged for data exfiltration.
• SEO Poisoning techniques used: Cybereason’s IR team discovered SEO Poisoning techniques used to spread malware. It works when the threat actors create fraudulent websites. Essentially, threat actors optimize fraudulent websites to appear higher in search engine results. It is likely the higher the search engines results, the more likely victims will click on the links.
Click to expand...

• Post-exploitation activities detected by Cybereason: Cybereason Defense Platform generates detections upon these infections and post-exploitation actions.
• Severe Threat: Cybereason’s IR team assesses the threat level as SEVERE given the potential of the attacks.
• Targeting English-Speaking Countries: GootLoader targets companies in English-speaking countries, primarily the United States, United Kingdom and Australia.
• Target Industries Including Healthcare and Finance: Targeted attacks have been more prominent against healthcare and finance organizations.
Click to expand...

Log in or Sign up

Gootkit Loader Resurfaces with Updated Tactic to Compromise Targeted Computers

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Gootkit Loader Resurfaces with Updated Tactic to Compromise Targeted Computers

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches