In the rapidly evolving world of cyber threats, we are faced with another adversary – a new variant of the GootLoader malware. This variant, known as ‘GootBot,’ is designed to facilitate lateral movement on compromised systems and evade detection. As cybersecurity experts grapple with the new strains of malware every day, it becomes increasingly essential to stay abreast of the latest developments.
Let’s delve deeper into the nature of this new cybersecurity threat.
GootLoader, originally, is a malware that takes advantage of search engine optimization (SEO) poisoning tactics to entrap potential victims. Usually, it functions by downloading next-stage malware. It is associated with a notorious threat actor tracked as Hive0127, also known as UNC2565.
Unlike its successor, the newly observed GootBot is an obfuscated PowerShell script that serves as a payload following a Gootloader infection, rather than operating as a post-exploitation framework like CobaltStrike.
Working round the clock, cybersecurity researchers have provided us with intricate details of how GootBot operates.
Upon gaining entry into a network system through SEO-poisoned business-related searches, victims are led into manipulated websites appearing to be legitimate forums. Here, they are tricked into downloading initial payloads disguised as archive files. These payloads consist of an obfuscated JavaScript file. Once executed, they fetch another JavaScript file designed to persistently function via a scheduled task.
This secondary JavaScript is employed to run a PowerShell script that exfiltrates system information to a remote server. In turn, this server delivers another PowerShell script that runs ad infinitum, providing threat actors the ability to distribute various assortments of payloads, including GootBot.
GootBot also introduces another worrying feature – a unique, hard-coded command and control (C2) server for each sample, making it quite challenging to block the malicious traffic. GootBot keeps reaching out to its C2 server every 60 seconds to fetch PowerShell tasks, which subsequently execute and transmit execution results to the server via HTTP POST requests.
The grave issue with GootBot is its ability to perform functions ranging from reconnaissance to executing lateral movement across the environment – hence, broadening the attack scale considerably.
This discovery underlines the extraordinary lengths attackers will go to ensure evasion detection and stealth operations. This change in malware tactics, techniques, and procedures certainly heightens the risk of successful post-exploitation stages, including those linked to GootLoader-related ransomware affiliate activity.
In conclusion, our proactive response to cybersecurity threats like GootBot hinges significantly on our understanding of their nature and movements. Stay informed, stay safe.
Related Articles:
https://thehackernews.com/2023/11/new-gootloader-malware-variant-evades.html