Gootkit Malware Continues to Evolve with New Components and Obfuscations

[silversurfer]

Content source

https://thehackernews.com/2023/01/gootkit-malware-continues-to-evolve.html

The threat actors associated with the Gootkit malware have made "notable changes" to their toolset, adding new components and obfuscations to their infection chains.

Google-owned Mandiant is monitoring the activity cluster under the moniker UNC2565, noting that the usage of the malware is "exclusive to this group."

Gootkit, also called Gootloader, is spread through compromised websites that victims are tricked into visiting when searching for business-related documents like agreements and contracts via a technique called search engine optimization (SEO) poisoning.

The purported documents take the form of ZIP archives that harbor the JavaScript malware, which, when launched, paves the way for additional payloads such as Cobalt Strike Beacon, FONELAUNCH, and SNOWCONE.

FONELAUNCH is a .NET-based loader designed to load an encoded payload into memory, whereas SNOWCONE is a downloader that's tasked with retrieving next-stage payloads, typically IcedID, via HTTP.

Gootkit Malware Continues to Evolve with New Components and Obfuscations

Gootkit malware continues to evolve and become more sophisticated, with notable changes to the toolkit, adding new components and obfuscations.

thehackernews.com

 

[silversurfer]

The Gootkit malware is prominently going after healthcare and finance organizations in the U.S., U.K., and Australia, according to new findings from Cybereason.

The cybersecurity firm said it investigated a Gootkit incident in December 2022 that adopted a new method of deployment, with the actors abusing the foothold to deliver Cobalt Strike and SystemBC for post-exploitation.

"The threat actor displayed fast-moving behaviors, quickly heading to control the network it infected, and getting elevated privileges in less than 4 hours," Cybereason said in an analysis published February 8, 2023.

Gootkit Malware Adopts New Tactics to Attack Healthcare and Finance Firms

Gootkit malware is now targeting healthcare and financial organizations in the US, UK and Australia by using a new method of deployment.

thehackernews.com