eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
We found Gootloader, a JavaScript-based malware distributed via drive-by social engineering attacks. The malware uses black hat Search Engine Optimization (SEO) techniques to increase discoverability and deliver code hidden within legitimate jQuery files.
Gootloader is a concerning threat as it’s been widely observed delivering Cobalt Strike to infected systems.
In July 2022, eSentire’s team of 24/7 Cyber SOC Analysts disrupted multiple infections across customers in legal services and construction industries.
Black hat SEO techniques typically rely on a combination of SEO poisoning, keyword generation, and keyword stuffing to be successful:
SEO Poisoning Tactics
In a typical infection scenario, the victim performs a web search containing keywords in Gootloader’s target list. These typically include keywords such as “agreement”, “contract” and “form”. For example:
Commercial Lease Agreement Indiana
Personal Tax Credit Return Form Help
Confidentiality Agreement Workplace
Consumer Credit Act Contract Law
Keyword Generation
A key to Gootloader’s success is the discoverability of their landing pages hosted on compromised WordPress sites. These pages are not actively delivered to victims; instead unsuspecting users stumble upon them as they’re searching for various topics.
Analysis of just 3 compromised websites revealed nearly 400 pages with unique titles aimed at the above search terms.
Various how-to guides on keyword generation can be found on forums such as Hackforums or Black Hat World (Figure 1).
These guides describe using freely available tools to generate and rank keyword phrases that will increase traffic from search engines for a particular topic.
Figure 1 June 2022 post from Black Hat World forum describing targeted keyword generation.
Figure 2 Keyword Engineer can generate thousands of real search phrases based on a single keyword.
Figure 3 Similar to Keyword Engineer, Ahrefs’ Keyword Generator identifies search phrases tied to a single keyword. In addition, the tool provides keyword rankings and the option for question-based queries.
TRU compared a list of generated keywords to Gootloader pages and found some complete or partial overlap. We assess Gootloader operators employ such tools for generating SEO keywords.
Keyword Stuffing
Gootloader operators employ a technique known as “keyword stuffing” to manipulate the site’s ranking in search results. Content is auto-generated containing keywords/phrases stitched together from different sources.
Figure 4 Compromised website containing generated content for manipulating SEO.
This content is hidden from the victim on their first visit. Instead, a forum post is presented dynamically to the user posing as a Q&A topic on the subject searched by the victim.
In a blog post from 2021, Sophos described in detail how the forum overlay is injected and subsequently hidden from unwanted targets such as web crawlers and researchers.
The download link leads to Gootloader’s JavaScript payload which is subsequently executed by the victim.
Our team of 24/7 Cyber SOC Analysts alerted and isolated the hosts in accordance with the customer policy.
We also provided remediation steps for removing persistence artifacts.
What can you learn from this TRU positive?
Black hat SEO techniques are employed by Gootloader operators to increase discoverability, particularly among victims who handle legal contracts or agreements.
Gootloader continues to actively develop their payloads in response to defensive countermeasures and researcher tools.
Cobalt Strike is a common precursor to interactive intrusions. The tool is ubiquitous with extortion/ransomware groups.
The combination of the targeted keywords and the malware’s checks for domain-joined systems suggests a foothold within business targets is the goal.
In recent cases, Gootloader’s code was interlaced within a legitimate jQuery file, a strategy aimed at impeding automated analysis/deobfuscation (Figure 6).
Further analysis by the TRU team identified Cobalt Strike as the final payload.
Figure 6 Gootloader code found in legitimate jQuery file (left), cleaned up (right).
Recommendations from our Threat Response Unit (TRU) Team:
Address security issues in Active Directory by thoroughly reviewing and securing SYSVOL permissions, patching any known vulnerabilities, implementing Least-Privilege administrative models.
Ensure standard procedures are in place for employees to submit potentially malicious content for review.
Ask Yourself...
Do your users commonly interact with internet-sourced documents?
Do you have protections in place to identify and contain executable content disguised as office documents?
Indicators of Compromise
Indicator
Note
7d26c7e88140d80358a4fd2b0ecfe73d
Gootloader JavaScript
Lohevisto[.]com
NGootloader C2
Losgaucos[.]cz
Gootloader C2
Liparicasa[.]it
Gootloader C2
93.115.29.50
Cobalt Strike C2
eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.
If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.
Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Cybersecurity Specialist.
eSentire Threat Response Unit (TRU)
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.
Cookies allow us to deliver the best possible experience for you on our website - by continuing to use our website or by closing this box, you are consenting to our use of cookies. Visit our Privacy Policy to learn more.
