Cybereason, a cybersecurity firm, recently discovered that the Gootkit malware is targeting healthcare and finance organizations in the U.S., U.K., and Australia. This malware has been linked to a threat actor known as UNC2565 and was first seen in 2014 as a banking trojan. It has since evolved into a loader that can deliver other malicious payloads. The attack chain involves luring victims to a booby-trapped website by poisoning search engine results. The malicious code is hidden within legitimate JavaScript libraries such as jQuery and Chroma.js. This then leads to the deployment of a 40 MB JavaScript payload that establishes persistence and launches the malware. In the incident investigated by Cybereason, Gootloader was used to deploy Cobalt Strike and SystemBC for post-exploitation. This is part of a larger trend of malware operators abusing Google Ads to distribute their malicious software. The evolution of Gootloader into a sophisticated loader shows how threat actors are constantly adapting their tactics to maximize their profits.
This Cyber News was published on thehackernews.com. Publication date: Thu, 09 Feb 2023 10:56:02 +0000