In January and February of 2023, six different law firms were targeted as part of two disparate threat campaigns distributing GootLoader and FakeUpdates (aka SocGholish) malware strains. GootLoader is a first-stage downloader that's capable of delivering a wide range of secondary payloads such as Cobalt Strike and ransomware. It notably employs search engine optimization (SEO) poisoning to funnel victims searching for business-related documents toward drive-by download sites that drop the JavaScript malware.
In the campaign detailed by cybersecurity company eSentire, the threat actors are said to have compromised legitimate, but vulnerable, WordPress websites and added new blog posts without the owners' knowledge. "When the computer user navigates to one of these malicious web pages and hits the link to download the purported business agreement, they are unknowingly downloading GootLoader," eSentire researcher Keegan Keplinger said in January 2022.
The disclosure from eSentire is the latest in a wave of attacks that have utilized the Gootkit malware loader to breach targets. GootLoader is far from the only JavaScript malware targeting business professionals and law firm employees. A separate set of attacks have also entailed the use of SocGholish, which is a downloader capable of dropping more executables. The infection chain is further significant for taking advantage of a website frequented by legal firms as a watering hole to distribute the malware.
These types of attacks are becoming more and more common, as cybercriminals target businesses and professionals who may be handling sensitive information. It's important to be aware of the dangers of clicking on links or downloading files from unknown sources, as this is often how these malicious programs are spread. If you think you may have been a victim of such an attack, it's important to seek professional help to remove the malware and secure your system to prevent further damage.