Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
- We found Gootloader, a JavaScript-based malware distributed via drive-by social engineering attacks. The malware uses black hat Search Engine Optimization (SEO) techniques to increase discoverability and deliver code hidden within legitimate jQuery files.
- Gootloader is a concerning threat as it’s been widely observed delivering Cobalt Strike to infected systems.
- In July 2022, eSentire’s team of 24/7 Cyber SOC Analysts disrupted multiple infections across customers in legal services and construction industries.
- Black hat SEO techniques typically rely on a combination of SEO poisoning, keyword generation, and keyword stuffing to be successful:
SEO Poisoning Tactics
In a typical infection scenario, the victim performs a web search containing keywords in Gootloader’s target list. These typically include keywords such as “agreement”, “contract” and “form”. For example:
- Commercial Lease Agreement Indiana
- Personal Tax Credit Return Form Help
- Confidentiality Agreement Workplace
- Consumer Credit Act Contract Law
Keyword Generation
A key to Gootloader’s success is the discoverability of their landing pages hosted on compromised WordPress sites. These pages are not actively delivered to victims; instead unsuspecting users stumble upon them as they’re searching for various topics.
- Analysis of just 3 compromised websites revealed nearly 400 pages with unique titles aimed at the above search terms.
- Various how-to guides on keyword generation can be found on forums such as Hackforums or Black Hat World (Figure 1).
- These guides describe using freely available tools to generate and rank keyword phrases that will increase traffic from search engines for a particular topic.
- Tools such as https://keywordtool.io/ , https://ahrefs.com/keyword-generator or https://www.keyword.engineer/ can be used to generate lists of thousand search phrases (Figures 2 and 3).
TRU compared a list of generated keywords to Gootloader pages and found some complete or partial overlap. We assess Gootloader operators employ such tools for generating SEO keywords.
Keyword Stuffing
Gootloader operators employ a technique known as “keyword stuffing” to manipulate the site’s ranking in search results. Content is auto-generated containing keywords/phrases stitched together from different sources.
- This content is hidden from the victim on their first visit. Instead, a forum post is presented dynamically to the user posing as a Q&A topic on the subject searched by the victim.
- In a blog post from 2021, Sophos described in detail how the forum overlay is injected and subsequently hidden from unwanted targets such as web crawlers and researchers.
- The download link leads to Gootloader’s JavaScript payload which is subsequently executed by the victim.
How did we find it?
- BlueSteel, our machine-learning powered PowerShell classifier, identified PowerShell commands executed by Gootloader.
What did we do?
- Our team of 24/7 Cyber SOC Analysts alerted and isolated the hosts in accordance with the customer policy.
- We also provided remediation steps for removing persistence artifacts.
What can you learn from this TRU positive?
- Black hat SEO techniques are employed by Gootloader operators to increase discoverability, particularly among victims who handle legal contracts or agreements.
- Gootloader continues to actively develop their payloads in response to defensive countermeasures and researcher tools.
- Cobalt Strike is a common precursor to interactive intrusions. The tool is ubiquitous with extortion/ransomware groups.
- The combination of the targeted keywords and the malware’s checks for domain-joined systems suggests a foothold within business targets is the goal.
July 2022 Gootloader Payload
- For complete analysis, eSentire’s TRU team published detailed analysis of Gootloader in July 2022 https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-gootloader-and-icedid.
- In recent cases, Gootloader’s code was interlaced within a legitimate jQuery file, a strategy aimed at impeding automated analysis/deobfuscation (Figure 6).
- Further analysis by the TRU team identified Cobalt Strike as the final payload.
Recommendations from our Threat Response Unit (TRU) Team:
- Implement a Phishing and Security Awareness Training (PSAT) program that educates & informs employees on emerging threats in the threat landscape.
- Confirm that all devices are protected with Endpoint Detection and Response (EDR) solutions.
- Address security issues in Active Directory by thoroughly reviewing and securing SYSVOL permissions, patching any known vulnerabilities, implementing Least-Privilege administrative models.
- Ensure standard procedures are in place for employees to submit potentially malicious content for review.
Ask Yourself...
- Do your users commonly interact with internet-sourced documents?
- Do you have protections in place to identify and contain executable content disguised as office documents?
Indicators of Compromise
| Indicator | Note |
| 7d26c7e88140d80358a4fd2b0ecfe73d | Gootloader JavaScript |
| Lohevisto[.]com | NGootloader C2 |
| Losgaucos[.]cz | Gootloader C2 |
| Liparicasa[.]it | Gootloader C2 |
| 93.115.29.50 | Cobalt Strike C2 |
eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.
If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.
Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Cybersecurity Specialist.
