Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


09:25 AM
Connect Directly

Attacker Expands Use of Malicious SEO Techniques to Distribute Malware

The operators of REvil and Gootkit have begun using a tried and tested technique to distribute additional malware, Sophos says.

An innovative method that the operators of the REvil ransomware strain and the Gootkit banking Trojan have been using for years to distribute their malware is now being used to deliver other malware as well, including the Kronos Trojan and the Cobalt Strike attack kit.

Researchers from Sophos who have been tracking the threat have dubbed the delivery mechanism Gootloader. In a new report, they described the method as deserving close scrutiny for the manner in which it leverages malicious search engine optimization (SEO) techniques as part of the malware deployment process.

Related Content:

Malware Developers Refresh Their Attack Tools

Special Report: How IT Security Organizations Are Attacking the Cybersecurity Problem

New From The Edge: Securing Super Bowl LV

The method basically involves the attackers maintaining a fairly large network of servers hosting legitimate but previously compromised websites. In each instance, the attackers exploit vulnerabilities in the website's content management system to essentially inject a mostly unintelligible collection of words and phrases — commonly referred to as a "word salad."

The goal is to fool search engines into thinking a compromised website is about those words, when in reality it might be about something else entirely, says Chester Wisniewski, principal research scientist at Sophos. For example, one compromised website that Sophos observed being used in the Gootkit campaign belonged to a neonatal clinic in Canada. Because of the random collection of words and phrases that had been inserted into it, the site appeared as the top link in Google search results in response to a query about a very narrow type of real estate agreement.

"Maybe you search for 'connect Bluetooth toothbrush to Motorola Android phone,'" Wisniewski explains by way of an example. "It just so happens that the criminals had compromised an insecure WordPress site last week and amongst the word salad they injected were words like 'Motorola,' 'Android,' and 'toothbrush,'" he says. Google gets tricked into thinking the site is an expert on the topic and serves up the page as a top link in search results.

Because the result seems to match the original search query exactly, the user gets fooled into clicking on the link and ends up being directed to what appears to be a forum page on the compromised website, where people are seemingly discussing the identical topic. On the webpage is a download link, apparently posted by the forum administrator, to a document purporting to contain the answer to the user's search query. The link, too, contains the exact search terms and in the same order as used in the original search query. Users that click on the link end up downloading a ZIP file — again with the same search terms—containing a malicious JavaScript that is disguised to look like a document. "You open the 'document' and run the JavaScript, which infects your PC," Wisniewski says.

Constructing Payloads on the Fly
The JavaScript file is the only stage of the attack chain where a malicious file is written to the filesystem, according to the report. Every other malicious activity that is initiated after the script runs happens in memory and out of sight of most endpoint protection tools, the vendor notes.

The security vendor's analysis of Gootloader shows the mechanism is designed to serve up the fake forum page only to users who arrive at a compromised website by following a Google search result. The Gootloader process also determines whether the site visitor's computer is running an operating system with the specific language and geolocation preferences that the attackers are targeting. If any of these conditions are not met, the fake forum page is not served up to someone who ends up on the compromised website.

The adversaries have developed a method where the site from which the malicious file is downloaded is able to construct payloads "on the fly" with a file name that matches the original search query, Sophos says. The company found that users were searching for things as random as "Cisco WPA agreement" and "employee retention bonus agreement template" when they were presented with links to a compromised website purporting to have an answer to their specific query.

Sophos says the infection method appears to target only users conducting searches on Google. It also appears to mostly work for search types where there isn't a clearly credible expert page to send users to, Wisniewski adds. "It's very difficult to trick Google about 'Donald Trump' or 'Watergate,'" he notes. So, many of the searches where users end up on a compromised site are for odd combinations of generic things. "This is why the word salad approach works so well," he says.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-24
In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with &lt...
PUBLISHED: 2021-06-24
The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuously. The packet is in an incorrect format and cannot be decoded by the node correctly. As a result, the node may consume the memory sustainabl...
PUBLISHED: 2021-06-23
Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok. Successful attacks of this vulnerability can result in takeover of OpenGrok. CVSS 3.1 ...
PUBLISHED: 2021-06-23
A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability.
PUBLISHED: 2021-06-23
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.