GootLoader Hackers Targeting Employees of Law and Accounting Firms

[silversurfer]

Content source

https://thehackernews.com/2022/01/gootloader-hackers-targeting-employees.html

Operators of the GootLoader campaign are setting their sights on employees of accounting and law firms as part of a fresh onslaught of widespread cyberattacks to deploy malware on infected systems, an indication that the adversary is expanding its focus to other high-value targets.

"GootLoader is a stealthy initial access malware, which after getting a foothold into the victim's computer system, infects the system with ransomware or other lethal malware," researchers from eSentire said in a report shared with The Hacker News. The cybersecurity services provider said it intercepted and dismantled intrusions aimed at three law firms and an accounting enterprise. The names of the victims were not disclosed.

"GootLoader relies heavily on social engineering to establish its foothold, from poisoning Google search results to fashioning the payload," said Keegan Keplinger, research and reporting lead for eSentire's Threat Response Unit (TRU). "GootLoader's operators invite employees to seek, download, and execute their malware under the guise of a free business agreement template. This is particularly effective against legal firms, who may encounter uncommon requests from clients."

GootLoader Hackers Targeting Employees of Law and Accounting Firms

GootLoader malware campaign now targets employees of law and accounting firms.

thehackernews.com

 

[Andy Ful]

Detailed analysis of GootLoader (from previous campaigns):

“Gootloader” expands its payload delivery options

The Javascript-based infection framework for the Gootkit RAT increasingly delivers a wider variety of malware, including ransomware payloads, filelessly

news.sophos.com

Gootloader: ‘Initial Access as a Service’ Platform Expands Its Search for High Value Targets - SentinelLabs

Gootloader expands its scope to target military, pharmaceutical and energy sectors, operating on an Initial Access As a Service model.

www.sentinelone.com