Gootkit malware returns to life alongside REvil ransomware

guest · Nov 30, 2020

Gootkit malware returns to life alongside REvil ransomware
November 30, 2020
https://www.bleepingcomputer.com/ne...e-returns-to-life-alongside-revil-ransomware/

After a year-long vacation, the Gootkit information-stealing Trojan has returned to life alongside REvil Ransomware in a new campaign targeting Germany.

The Gootkit Trojan is Javascript-based malware that performs various malicious activities, including remote access for threat actors, keystroke capturing, video recording, email theft, password theft, and the ability to inject malicious scripts to steal online banking credentials.
Last year, the Gootkit threat actors suffered a data leak after leaving a MongoDB database exposed on the Internet.
Click to expand...

Gootkit bursts back to life with ransomware partnership
Last week, a security researcher known as The Analyst told BleepingComputer that the Gootkit malware had emerged again in attacks targeting Germany.

In this new malicious campaign, threat actors are hacking WordPress sites and utilizing SEO poisoning to display fake forum posts to visitors. These posts pretend to be a question and answers with a link to fake forms or downloads.
Click to expand...

Gootkit and REvil installed in fileless attacks
In a new report released today, Malwarebytes' researchers explain that the malicious JavaScript payloads will perform fileless attacks of either Gootkit or REvil.
In Malwarebytes' analysis, this payload is usually Gootkit, but it was also REvil ransomware in some cases.

"After conversion to ASCII, the next JavaScript is revealed, and the code is executed. This JavaScript comes with an embedded PE payload which may be either a loader for Gootkit, or for the REvil ransomware. There are also some differences in the algorithm used to deobfuscate it," Malwarebytes stated in their report.
Click to expand...

Malwarebytes: German users targeted with Gootkit banker or REvil ransomware

While analyzing the complex malware loader we made a surprising discovery. Victims receive Gootkit itself or, in some cases, the REvil (Sodinokibi) ransomware. The decision to serve one or the other payload happens after a check with the criminal infrastructure.
Click to expand...

Log in or Sign up

Gootkit malware returns to life alongside REvil ransomware

guest Guest

Log in or Sign up

Gootkit malware returns to life alongside REvil ransomware

guest Guest

Useful Searches