Gootloader Malware: Early Detection and Remediation

The eSentire Threat Response Unit (TRU) has recently observed an increase in Gootloader malware attacks, specifically targeting law firms and corporate legal departments. This malware uses Search Engine Optimization (SEO) poisoning tactics to distribute infected files to users searching for document templates.

Once a user opens the document, the malware is executed, allowing the threat actors to gain Initial Access into the victim’s organization. From there, the attackers can deploy malicious ransomware, causing business disruption.

In this video, Spence Hutchinson, Staff Threat Intelligence Researcher, discusses why early detection and complete response are crucial to containing this cyber threat.