Cybersecurity researchers at Sophos have found that hackers are using search engine optimization to push compromised websites higher up Google's rankings and more widely deploy malware payloads.
The "Gootloader" technique involves deploying the injection framework for the Gootkit Remote Access Trojan, which researchers said would require the maintenance of a network of 400 or more servers at any given time.
The researchers said hackers are gaining access to websites' content management systems via malware, stolen credentials, or brute-force attacks, after which they insert a few lines of code into the body of website content.
The compromised websites are manipulated to answer specific search queries, displaying fake message boards with posts containing an answer to the query and a direct download link.
Gootloader is being used to deploy malware variants including the Gootkit banking Trojan, Kronos, Cobalt Strike, and REvil ransomware in the U.S., South Korea, Germany, and France.
View Full Article
Abstracts Copyright © 2021 SmithBucklin, Washington, DC, USA