Combine cutting-edge XDR technology, multi-signal threat intelligence and 24/7 Elite Threat Hunters to help you build a world-class security operation.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Cyber risk and advisory programs that identify security gaps and build security strategies to address them.
XDR with machine learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
24/7 SOC-as-a-Service with unlimited threat hunting and incident handling.
Proactive threat intelligence, original threat research and a world-class team of seasoned industry veterans.
Extend your team capabilities and prevent business disruption with expertise from eSentire.
Stop ransomware before it spreads.
Meet regulatory compliance mandates.
Detect and respond to zero-day exploits.
End misconfigurations and policy violations.
Defend third-party and supply chain risk.
Prevent disruption by outsourcing MDR.
Adopt a risk-based security approach.
Meet insurability requirements with MDR.
Protect your most sensitive data.
Defend brute force attacks, active intrusions and unauthorized scans.
Guard endpoints by isolating and remediating threats to prevent lateral spread.
Investigation and threat detection across multi-cloud or hybrid environments.
Remediate misconfigurations, vulnerabilities and policy violations.
Defend brute force attacks, active intrusions and unauthorized scans.
THE THREAT On February 20th, ConnectWise confirmed that two recently disclosed ScreenConnect vulnerabilities are now under active exploitation. The vulnerabilities are currently tracked as…Feb 09, 2024
THE THREAT On February 7th, CISA, NSA, FBI, along with Five Eyes intelligence partners, published a joint advisory related to state-sponsored threat actors from the People’s Republic of…
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Waterloo, ON–February 7, 2024 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced that three of Australia’s top Value-Added Resellers (VARs): Advance Vision Technology, Exigo Tech, and Rubicon 8 have joined eSentire’s CRN 5-Star e3 partner…
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
In an unreported first - GootLoader, a popular malware-as-a-service (MaaS) offering which leverages Search Engine Optimization (SEO) poisoning to distribute malicious payloads, has dropped IcedID as a payload while simultaneously shifting to a stealthier payload delivery procedure. IcedID is a former banking-trojan, turned malware loader. On May 30th, eSentire‘s research team, the Threat Response Unit (TRU), discovered that threat actors were trying to deploy IcedID onto a law firm‘s IT network via an employee‘s computer. eSentire‘s Security Operations Centre (SOC) immediately isolated the infected endpoint, and worked with TRU to diagnose the malware as IcedID, after cleaning the endpoint and ensuring that the legal firm‘s IT environment was clean and safe.
TRU has disrupted 16 distinct GootLoader incidents since January 2022, involving the Software, Legal, and Customer Service industries. However, most of these GootLoader campaigns have come and gone with little change (Figure 1), often deploying a generic Cobalt Strike beacon in default configuration. This method leverages noisy Windows registry keys, making detection difficult. The Windows operating system uses the registry to store configuration data for applications and Windows itself.
Figure 1 - Industries impacted by GootLoader's SEO poisoning procedure.
GootLoader dropping IcedID as a payload is significant because TRU recently observed IcedID deploying customized configurations of Cobalt Strike, the primary hands-on intrusion tool leveraged by some of the most lethal ransomware groups such as Conti, REvil, FiveHands and BlackCat. In particular, TRU has seen IcedID deliver Cobalt Strike in under 20 minutes from the time of the IcedID infection, giving organizations little time to respond before the threat actors compromise their network. The introduction of an additional step in the attack chain could serve several purposes, from obscuring the final payload to utilizing more sophisticated Cobalt Strike builds that are associated with IcedID.
TRU has disrupted 16 distinct GootLoader incidents since January 2022, involving the Software, Legal, and Customer Service industries.
Figure 2 - An employee is tricked into downloading what they believe is a sample agreement.
In 2021, the security community saw the hackers behind GootLoader abandon an exclusive delivery model, in which it only dropped the GootKit Remote Access Trojan (RAT), and began focusing on adapting their loader to other payloads. In 2021, GootLoader was reported dropping an array of payloads, including the REvil ransomware (aka Sodinokibi), Cobalt Strike and the Gootkit banking trojan.
In recent incidents involving GootLoader, the malware would write the Cobalt Strike payload to the Phone registry keys, a relatively easy detection. However, in the May 30th incident, GootLoader is using a more common registry key. As a result, the activity is more prone to false positives and some security teams might be hesitant to implement detections for it.
It‘s unclear whether customers of the GootLoader MaaS get to choose the registry targets, in addition to choosing their payload. However, this update reflects a small evolutionary step in GootLoader‘s malware delivery offering.
Two payloads were written to the victim’s User Registry Keys under:
After extracting and decrypting the payload from the registry keys, TRU identified the payload as IcedID.
As previously stated, TRU has seen GootLoader exclusively using Cobalt Strike payloads in 2022. However, the Cobalt Strike beacon profiles for these samples demonstrated default settings, making them easy to find in the wild. This could be a sign that the actors managing the Cobalt Strike payload do not have the capabilities to configure stealthy Beacons – or that they really want to blend in so as to reduce the chance that their uniquely identifiable Tactics, Techniques, and Procedures (TTPs) will be detected. Despite these easily discoverable Cobalt Strike servers, GootLoader campaigns have recently resulted in successful hands-on intrusions.
In contrast, Cobalt Strike configurations associated with IcedID, particularly in connection to Conti and FiveHands ransomware infrastructure, were more sophisticated. Incidents utilizing this Cobalt Strike infrastructure leveraged malleable Command & Control (C2) profiles and custom injection targets which allowed intruders to hide their C2 and subsequent intrusion activities.
In GootLoader -> IcedID incident observed by TRU, IcedID‘s payload was not observed, but TRU acknowledges that future GootLoader infections could lead to more sophisticated Cobalt Strike infections.
If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services to disrupt threats before they impact your business. Want to learn more about how we protect organizations globally? Connect with an eSentire Security Specialist.
GootLoader C2 exracted from .js file:
employee confidentiality agreement texas(9898).zip
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.