Gootloader Incident with Academics Partner on March 25, 2024
Topline Takeaways
- Date of incident: March 25, 2024
- Industry target: Academics
- Relevant attacker information:
- Gootloader
- agent[.]js
- Scheduled task “Firefox Default Browser Agent”
- Malicious attachment “chase_statement_Jan_2024[.]zip”
- Blackpoint SOC actions:
- Isolated impacted endpoint(s)
- Called client about the incident and provided additional remediation advice
- Why this incident matters to you:
- The APG predicts that it is likely (55-80%) that threat actors will continue to use Gootloader and loader malware to infect other academic organizations over the next 12 months.
- Recommended remediations and mitigations:
- Improve endpoint, asset, and network visibility
- Use a content proxy
- Heuristics-based network activity monitoring
- Scripting language controls
Gootloader Ransomware Incident Timeline for March 25, 2024
- 3:16 p.m. EST: Blackpoint’s MDR alerted to malicious activity.
- 4:29 p.m. EST: An MDR analyst began initial triage.
- 4:35 p.m. EST: They isolated the infected endpoints from all external and internal communications.
- 4:36 p.m. EST: They spoke to the academic partner about incident and provided additional remediation advice.
What happened?
Last Monday, the Blackpoint SOC was alerted to the Gootloader family of malware infection on an academic partner’s host.
SOC analysts observed a scheduled task titled “Firefox Default Browser Agent” executing on the host, with a JScript file “agent[.]js”.
This JScript file then attempted to use PowerShell to connect to an external malicious domain for command and control (C2).
Blackpoint SOC isolated the host to prevent additional compromise, and reached out to the client about the incident and additional steps that should be taken.
What is Gootloader?
Active since 2020, Gootloader is a first-stage downloader designed to attack Windows-based operating systems.
Gootloader malware is offered by criminals on the dark web as an Initial-Access-as-a-Service (IAaaS) tool.
While Gootloader’s first observed second-stage payload was GootKit, a 2014 banking trojan and stealer – hence, the name “Gootloader” – it is often used to deploy other second stage payloads, including:
- Ransomware, such as REvil and Rhysida,
- Stealer malware, and
- Cobalt Strike beacons.
In addition to deploying a second-stage payload, Gootloader can establish a threat actor’s persistence within a victim’s network using PowerShell commands to create scheduled tasks which periodically load and run the primary payload.
Gootloader has been observed gaining initial access via:
- WordPress vulnerabilities,
- Malicious JavaScript files which impersonate legitimate documents,
- Social engineering attacks with malicious ZIP attachments, and
- Search engine optimization (SEO) poisoning, luring victims to drive-by download campaigns that deliver the first stage payload.
How often will Gootloader be used by threat actors in 2024?
The APG predicts that threat actors will likely continue to use Gootloader and other malware loaders over the next 12 months against organizations in all industry verticals, including academic partners.
We base this assessment on internal Blackpoint attack trends against our partners and recent known use by active threat actors.
In November 2023, CISA released a #StopRansomware report related to the Rhysida ransomware (10), warning that the Rhysida ransomware operators had been observed using Gootloader for initial access and deploying the ransomware payload.
Additionally, in February 2024, security researchers with DarkTrace reported cyberattacks that utilized Gootloader during the attack to establish persistence and deploy second stage payloads (11).
Recommended Gootloader Mitigations and Remediations
The Blackpoint APG recommends the following actions to help mitigate Gootloader malware.
- Improve security visibility of networks, endpoints, and other managed assets to aid in detecting and alerting to malicious actions conducted by Gootloader and other malware.
- Use a content proxy to monitor internet usage and restrict user access to suspicious or potentially risky websites.
- Monitor system activity through heuristics-based triggers and alerts, rather than depending solely on indicators of compromise (IoCs) to detect unusual access patterns that could be indicative of malicious behavior by threat actors.
- Minimize the use of – or implement strict controls on – the use of scripting languages, as threat actors rely on scripting languages such as JavaScript to deploy malware and conduct malicious activities.
