Hackers now use SEO Malware to launch coordinated attacks

Sophos recently uncovered a concerning tactic cybercriminals are employing: leveraging SEO (Search Engine Optimization) techniques to launch coordinated attacks and deliver malware.

This method, dubbed “Gootloader,” utilizes both search engine optimization tactics and social engineering manipulation to push compromised websites to the top of search results, particularly targeting users in France, Germany, South Korea, and the United States.

Understanding Gootloader: The SEO-driven RAT Framework

Deploying the Gootkit RAT (Remote Access Trojan), Gootloader acts as an infection framework capable of delivering various malware payloads, including banking Trojans, ransomware, and information stealers.

This isn't a small-scale operation; researchers estimate attackers maintain a massive server network exceeding 400 servers to facilitate these attacks.

READ ALSO: Is Surfshark One Worth It? [Honest ANSWER]

Compromising Websites: Hijacking & Code Injections

While the specific methods of website compromise remain unclear, researchers suspect attackers exploit vulnerabilities in Content Management Systems (CMS) through malware, brute-force attacks, or stolen credentials.

Once gaining access, they inject malicious code into the website's content, manipulating it to respond to specific search queries.

Manipulating Search Results & Targeting Users

Sophos observed compromised websites, often disguised as fake message boards, subtly modify content depending on visitor searches.

If attacker criteria aren't met, the browser displays a seemingly normal page, quickly switching to irrelevant content. However, for targeted searches, a fake forum post appears containing the seemingly relevant answer alongside a malicious download link.

From Download to Payload: The Infection Chain

Clicking the download link leads to a .zip archive, named based on the search term, containing a malicious .js file.

This script executes in memory, decrypting obfuscated code that triggers the download and execution of additional malware payloads.

Sophos has identified Gootkit itself, REvil ransomware, Cobalt Strike, and Kronos among the distributed malware.

Protecting Yourself From SEO Malware: Stay Vigilant and Practice Safe Browsing

This sophisticated attack emphasizes the importance of vigilance and safe browsing practices.

Here are some key tips:

• Be cautious of search results: Scrutinize website legitimacy, especially those appearing suspiciously high in rankings.
• Maintain software updates: Regularly update your operating system, browser, and security software to patch vulnerabilities.
• Avoid suspicious downloads: Never download files from untrusted sources, even if they seem relevant to your search.
• Employ security tools: Consider using ad blockers and website reputation checkers for added protection.
• Beware of social engineering: Remain skeptical of manipulated content and unsolicited offers, especially when searching for sensitive information.

By staying informed and adhering to safe browsing practices, you can significantly reduce your risk of falling victim to SEO malware scams like Gootloader.

Interesting Reads

About the Author:

Chandra Palan

Writer at SecureBlitz | + posts

Chandra Palan is an Indian-born content writer, currently based in Australia with her husband and two kids. She is a passionate writer and has been writing for the past decade, covering topics ranging from technology, cybersecurity, data privacy and more. She currently works as a content writer for SecureBlitz.com, covering the latest cyber threats and trends. With her in-depth knowledge of the industry, she strives to deliver accurate and helpful advice to her readers.

• Important Things Every Manufacturing Business Should Do
• A Guide for Healthcare Businesses on Using New Technology
• A Guide on Open Enrollment for Employees
• 5 Top Music Streaming Services In The World