Tag Archive for: FakeUpdates

Cybercriminals Targeting Law Firms with GootLoader and FakeUpdates Malware

/in


Mar 01, 2023Ravie LakshmananThreat Intelligence / Malware

GootLoader and FakeUpdates Malware

Six different law firms were targeted in January and February 2023 as part of two disparate threat campaigns distributing GootLoader and FakeUpdates (aka SocGholish) malware strains.

GootLoader, active since late 2020, is a first-stage downloader that’s capable of delivering a wide range of secondary payloads such as Cobalt Strike and ransomware.

It notably employs search engine optimization (SEO) poisoning to funnel victims searching for business-related documents toward drive-by download sites that drop the JavaScript malware.

In the campaign detailed by cybersecurity company eSentire, the threat actors are said to have compromised legitimate, but vulnerable, WordPress websites and added new blog posts without the owners’ knowledge.

“When the computer user navigates to one of these malicious web pages and hits the link to download the purported business agreement, they are unknowingly downloading GootLoader,” eSentire researcher Keegan Keplinger said in January 2022.

GootLoader and FakeUpdates Malware

The disclosure from eSentire is the latest in a wave of attacks that have utilized the Gootkit malware loader to breach targets.

GootLoader is far from the only JavaScript malware targeting business professionals and law firm employees. A separate set of attacks have also entailed the use of SocGholish, which is a downloader capable of dropping more executables.

The infection chain is further significant for taking advantage of a website frequented by legal firms as a watering hole to distribute the malware.

Another standout aspect of the twin intrusion sets in the absence of ransomware deployment, instead favoring hands-on activity, suggesting that the attacks could have diversified in scope to include espionage operations.

“Prior to 2021, email was the primary infection vector used by opportunistic threat actors,” Keplinger said. From 2021 to 2023, browser-based attacks […] have steadily been growing to compete with email as the primary infection vector.”

“This has been largely thanks to GootLoader, SocGholish, SolarMarker, and recent campaigns leveraging Google Ads to float top search results.”

Found this article interesting? Follow us on

Source…

Microsoft Teams Hit by ‘FakeUpdates’ Malware Using Cobalt Strike; Here’s How to Prevent It

/in


Microsoft warned its users about recent “FakeUpdates” campaigns targeting  various types of companies, particularly the education sector that uses Teams videoconferencing app. 

According to a Bleeping Computer as shared by Threat Post, the tech giant warned its customers about the security threat using fake Microsoft Teams update ads as backdoors to infect networks with malware. They use Cobalt Strike in this campaign, which targets the K-12 education and other companies, which are currently dependent on videoconferencing apps such as Microsoft Teams amid the coronavirus pandemic.

Microsoft Teams Is Under Attack by ‘FakeUpdates’ Malware Using Cobalt Strike

(Photo : Microsoft)
Microsoft Teams Is Under Attack by ‘FakeUpdates’ Malware Using Cobalt Strike

Microsoft Teams: ‘FakeUpdates’ Malware Uses Cobalt Strike

According to a report, cyber attackers use Cobalt Strike to infect company networks outside the infection point.

Cobalt Strike is being used by threat actors to spread ransomware and other kinds of malware. It is a commodity attack-simulation tool, which was used in exploiting the privilege-elevation flaw Zerologon that allows attackers to gain access to the domain controller and fully compromise Active Directory identity services.

The Microsoft advisory stated that attackers in the recent FakeUpdates campaign used search-engine ads to promote Teams software top results into a domain that they can use and control for infamous activity. Then, if victims would click the link, it would download a payload and execute a PowerShell script that loads malicious content.

Cybercriminals use Cobalt Strike as payload, so threat actors can laterally move across the network beyond the initial infection system. It also installs a valid Microsoft Teams app on the system, so it seems legitimate and prevents victims from noticing the attack.

‘FakeUpdates’ Malware Uses Cobalt Strike

(Photo : Microsoft)
‘FakeUpdates’ Malware Uses Cobalt Strike

The advisory also stated that the campaign dispenses malware, which include the infostealer Predator the Thief, which steals sensitive data including account credentials, payment data, and browsers. The tech giant also noticed the latest campaigns spreading ZLoader and Bladabindi (NJRat) backdoor.

In…

Source…