Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Visibility and response across your entire Microsoft security ecosystem.
XDR with Machine Learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert threat hunting, original research, and proactive threat intelligence.
TRU is foundational to our MDR service. No add-ons or additional costs required.
Stop ransomware attacks before they disrupt your business.
Detect and respond to zero-day exploits.
Protect against third-party and supply chain risk.
Adopt a risk-based approach to cybersecurity.
Protect your most sensitive data.
Meet cybersecurity regulatory compliance mandates.
Eliminate misconfigurations and policy violations.
Prevent business disruption by outsourcing MDR.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and mediating threats to prevent lateral spread.
Enhance investigation and threat detection across multi-cloud or hybrid environments.
Remediate critical misconfigurations, security vulnerabilities and policy violations across cloud and containerized environments.
Detect malicious insider and identity-based behavior leveraging machine learning models.
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
In an unreported first - GootLoader, a popular malware-as-a-service (MaaS) offering which leverages Search Engine Optimization (SEO) poisoning to distribute malicious payloads, has dropped IcedID as a payload while simultaneously shifting to a stealthier payload delivery procedure. IcedID is a former banking-trojan, turned malware loader. On May 30th, eSentire‘s research team, the Threat Response Unit (TRU), discovered that threat actors were trying to deploy IcedID onto a law firm‘s IT network via an employee‘s computer. eSentire‘s Security Operations Centre (SOC) immediately isolated the infected endpoint, and worked with TRU to diagnose the malware as IcedID, after cleaning the endpoint and ensuring that the legal firm‘s IT environment was clean and safe.
TRU has disrupted 16 distinct GootLoader incidents since January 2022, involving the Software, Legal, and Customer Service industries. However, most of these GootLoader campaigns have come and gone with little change (Figure 1), often deploying a generic Cobalt Strike beacon in default configuration. This method leverages noisy Windows registry keys, making detection difficult. The Windows operating system uses the registry to store configuration data for applications and Windows itself.
Figure 1 - Industries impacted by GootLoader's SEO poisoning procedure.
GootLoader dropping IcedID as a payload is significant because TRU recently observed IcedID deploying customized configurations of Cobalt Strike, the primary hands-on intrusion tool leveraged by some of the most lethal ransomware groups such as Conti, REvil, FiveHands and BlackCat. In particular, TRU has seen IcedID deliver Cobalt Strike in under 20 minutes from the time of the IcedID infection, giving organizations little time to respond before the threat actors compromise their network. The introduction of an additional step in the attack chain could serve several purposes, from obscuring the final payload to utilizing more sophisticated Cobalt Strike builds that are associated with IcedID.
TRU has disrupted 16 distinct GootLoader incidents since January 2022, involving the Software, Legal, and Customer Service industries.
GootLoader operators use SEO poisoning to ensnare their victims, baiting them with fake templates of business agreements pertaining to topics such as employee confidentiality, plea agreements, aviation safety and postnuptial agreements. When victims search for these documents online, GootLoader leverages infected WordPress sites to deliver a malicious javascript file, disguised as an agreement example.
A business professional visits an infected website looking for a sample of an employee confidentiality agreement. Here they are presented with a forum overlay (Figure 2) and provided a link to download a zip archive, containing the malicious .js file. Once the employee executes the javascript file, they have initiated GootLoader which downloads and executes Cobalt Strike or IcedID.
Figure 2 - An employee is tricked into downloading what they believe is a sample agreement.
In 2021, the security community saw the hackers behind GootLoader abandon an exclusive delivery model, in which it only dropped the GootKit Remote Access Trojan (RAT), and began focusing on adapting their loader to other payloads. In 2021, GootLoader was reported dropping an array of payloads, including the REvil ransomware (aka Sodinokibi), Cobalt Strike and the Gootkit banking trojan.
In recent incidents involving GootLoader, the malware would write the Cobalt Strike payload to the Phone registry keys, a relatively easy detection. However, in the May 30th incident, GootLoader is using a more common registry key. As a result, the activity is more prone to false positives and some security teams might be hesitant to implement detections for it.
It‘s unclear whether customers of the GootLoader MaaS get to choose the registry targets, in addition to choosing their payload. However, this update reflects a small evolutionary step in GootLoader‘s malware delivery offering.
Two payloads were written to the victim’s User Registry Keys under:
After extracting and decrypting the payload from the registry keys, TRU identified the payload as IcedID.
As previously stated, TRU has seen GootLoader exclusively using Cobalt Strike payloads in 2022. However, the Cobalt Strike beacon profiles for these samples demonstrated default settings, making them easy to find in the wild. This could be a sign that the actors managing the Cobalt Strike payload do not have the capabilities to configure stealthy Beacons – or that they really want to blend in so as to reduce the chance that their uniquely identifiable Tactics, Techniques, and Procedures (TTPs) will be detected. Despite these easily discoverable Cobalt Strike servers, GootLoader campaigns have recently resulted in successful hands-on intrusions.
In contrast, Cobalt Strike configurations associated with IcedID, particularly in connection to Conti and FiveHands ransomware infrastructure, were more sophisticated. Incidents utilizing this Cobalt Strike infrastructure leveraged malleable Command & Control (C2) profiles and custom injection targets which allowed intruders to hide their C2 and subsequent intrusion activities.
In GootLoader -> IcedID incident observed by TRU, IcedID‘s payload was not observed, but TRU acknowledges that future GootLoader infections could lead to more sophisticated Cobalt Strike infections.
If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services to disrupt threats before they impact your business. Want to learn more about how we protect organizations globally? Connect with an eSentire Security Specialist.
IcedID sha256:
a9fc2b58e0e714a5135bff2d7c5c3a1d46359363696bdfa3feaabeb6f6bdc3af
IcedID C2:
64.227.182.2
ilekvoyn[.]com
GootLoader C2 exracted from .js file:
www[dot]liveshopping-aktuell[dot]de
www[dot]lightnessofbeing[dot]net
www[dot]lintelconsulting[dot]co[dot]uk
GootLoader filenames
employee confidentiality agreement texas(9898).zip
employee_confidentiality_agreement_texas 19855.js
Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.