Security News > 2023 > February > Gootkit Malware Adopts New Tactics to Attack Healthcare and Finance Firms
The Gootkit malware is prominently going after healthcare and finance organizations in the U.S., U.K., and Australia, according to new findings from Cybereason.
The cybersecurity firm said it investigated a Gootkit incident in December 2022 that adopted a new method of deployment, with the actors abusing the foothold to deliver Cobalt Strike and SystemBC for post-exploitation.
Starting its life in 2014 as a banking trojan, the malware has since morphed into a loader capable of delivering next-stage payloads.
Js, which is then used to spawn a secondary 40 MB JavaScript payload that establishes persistence and launches the malware.
The disclosure comes amid the ongoing trend of abusing Google Ads by malware operators as an intrusion vector to distribute a variety of malware such as FormBook, IcedID, RedLine, Rhadamanthys, and Vidar.
The evolution of Gootloader into a sophisticated loader is further reflective of how threat actors are constantly seeking new targets and methods to maximize their profits by pivoting to a malware-as-a-service model and selling that access to other criminals.
News URL
https://thehackernews.com/2023/02/gootkit-malware-adopts-new-tactics-to.html
Related news
- China-based Silver Fox spoofs healthcare app to deliver malware (source)
- Silver Fox APT Uses Winos 4.0 Malware in Cyber Attacks Against Taiwanese Organizations (source)
- ⚡ THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More (source)
- Chinese FamousSparrow hackers deploy upgraded malware in attacks (source)
- Open-source malware doubles, data exfiltration attacks dominate (source)
- Microsoft Warns of Tax-Themed Email Attacks Using PDFs and QR Codes to Deliver Malware (source)
- New TCESB Malware Found in Active Attacks Exploiting ESET Security Scanner (source)