Cybercriminals Targeting Law Firms with GootLoader and FakeUpdates Malware

Mar 01, 2023Ravie LakshmananThreat Intelligence / Malware

Six different law firms were targeted in January and February
2023 as part of two disparate threat campaigns distributing
GootLoader^[1] and FakeUpdates^[2] (aka SocGholish) malware
strains.

GootLoader^[3], active since late 2020,
is a first-stage downloader that’s capable of delivering a wide
range of secondary payloads such as Cobalt Strike and
ransomware.

It notably employs^[4]
search engine optimization (SEO) poisoning to funnel victims
searching for business-related documents toward drive-by download
sites that drop the JavaScript malware.

In the campaign^[5]
detailed by cybersecurity company eSentire, the threat actors are
said to have compromised legitimate, but vulnerable, WordPress
websites and added new blog posts without the owners’
knowledge.

“When the computer user navigates to one of these malicious web
pages and hits the link to download the purported business
agreement, they are unknowingly downloading GootLoader,” eSentire
researcher Keegan Keplinger said^[6]
in January 2022.

The disclosure from eSentire is the latest in a wave of attacks
that have utilized the Gootkit malware loader to breach
targets.

GootLoader is far from the only JavaScript malware targeting
business professionals and law firm employees. A separate set of
attacks have also entailed the use of SocGholish^[7], which is a downloader
capable of dropping more executables.

The infection chain is further significant for taking advantage
of a website frequented by legal firms as a watering hole^[8]
to distribute the malware.

Another standout aspect of the twin intrusion sets in the
absence of ransomware deployment, instead favoring hands-on
activity, suggesting that the attacks could have diversified in
scope to include espionage operations.

“Prior to 2021, email was the primary infection vector used by
opportunistic threat actors,” Keplinger said. From 2021 to 2023,
browser-based attacks […] have steadily been growing to compete
with email as the primary infection vector.”

“This has been largely thanks to GootLoader, SocGholish,
SolarMarker^[9], and recent campaigns
leveraging Google Ads^[10] to float top search
results.”