Criminal operators have turned the infection method for “Gootkit” financial malware into a complex delivery platform for a wide range of malware, including ransomware.
Sophos researchers have named the delivery platform, “Gootloader”.
Gootloader attackers reach their targets by hacking into legitimate websites and subtly altering the content. As a result, the websites can show different content to different visitors.
According to Sophos, the criminal operators manipulate search engine optimization (SEO) so that when someone types a question into a search engine such as Google, the hacked websites appear among the top results. What happens after users click on a link to a hacked website depends upon their country location.
For instance, if a user from a country that is not a “target” clicks on a hacked website, they are shown benign fake web content and nothing happens.
However, if users from one of Gootloader’s targeted countries click on a hacked website, they are shown a page featuring a fake discussion forum on the very topic they queried, using the same terms they typed into the search engine. The fake websites look the same regardless of whether they are in English, German or Korean.
The fake discussion forum includes a post from a “site administrator,” with a link to a download. The download is a malicious file. If targets click on it, the next stage of infection begins, Sophos warns.
From this point on, attacks proceed undercover, delivering the malicious payload to targets using a wide range of evasion techniques to avoid detection by security tools.
Gootloader is currently delivering Kronos financial malware in Germany, and a post-exploitation tool called Cobalt Strike in the US and South Korea. The attackers have also delivered REvil ransomware and the Gootkit trojan itself as payloads. Earlier operations targeted France.
“The developers behind Gootkit appear to have shifted resources from delivering just their own financial malware to steal credentials to creating a stealthy, complex delivery platform for all kinds of payloads, including REvil ransomware,” says Gabor Szappanos, threat research director at Sophos. “Gootloader’s creators use a number of social engineering tricks that can fool even technically skilled IT users.
“Fortunately, there are a few warning signs internet users can look out for. These include Google search results that point to websites for businesses that have no logical connection to the advice they appear to offer; advice that precisely matches the search terms used in the initial question; and a ‘message board’-style page that looks identical to the examples shown in the Sophos research, featuring text and a download link that also precisely matches the search terms used in the initial Google search.”
To protect against delivery systems such as Gootloader:
* Windows users can turn off the “Hide Extensions for Known File Types” view setting in the Windows file explorer as this will allow them to see that the .zip download delivered by the attackers contains a file with a .js extension.
* Script blockers like NoScript for Firefox could help web surfers remain safe by preventing the replacement of a hacked web page from appearing in the first place.
* Installing a comprehensive security solution that can scan for suspicious behavior from code running in computer memory.