WordPress Malware Attacks Using Gootloader

 WordPress is one of the most popular website-building platforms, it is also the target for many malicious hacker criminals. Experts warn WordPress site users to immediately update their WordPress installation core files, all plugins, and themes because hackers are using a new type of malware (Gootloader) to perform drive-by and watering-hole attacks.

What is WordPress?

WordPress is one of the world’s most popular CMS (content management system) platforms that developers and end-users employ to build websites, blogs, and e-commerce installations.

WordPress.com claims that 40% of all websites on the internet are built using WordPress. One of the most attractive features of WordPress is that it is free to download, install and use.

WordPress began as a simple platform for blogging but quickly expanded to become a full-fledged website-building tool that Fortune 500 companies as well as mom-and-pop shops use. The platform is well supported with thousands of great themes, plugins, and add-on software to enhance its functionality and features. People without any knowledge of programming or coding can use it to quickly and easily develop a website.

There is also a strong developer network, tutorials, and documentation if you run into trouble.

What Happened?

Threatpost reports that back in December, threat researchers noticed a new type of downloader malware called Gootloader that injects WordPress websites with dozens of pages of fake content. In December, some high-end retail organizations, hotels, music companies, healthcare organizations, educational institutes, and visual arts websites were attacked using Gootloader.

Threatpost stated that ‘“The threat actors’ end game is to infect business professionals, speaking English, German and Korean,” according to  a posting  on the campaign, issued Thursday. “Their modus operandi is to entice a business professional to one of the compromised websites, and then have them click on a link, leading to Gootloader, which attempts to retrieve the final payload, whether it be ransomware, a banking trojan or intrusion tool/credential stealer.”’

The Dangers of Gootloader

Most of the attacks witnessed by researchers involved an employee of a company searching for and downloading a free form or template. When they did, Gootloader was delivered instead. They found several dozen cases in education, medical facilities, and legal firms. Some of these attacks involved ransomware and others a Cobalt Strike.

The researchers responsible for getting the word out, eSentire, found dozens of infected WordPress websites with fake blog pages.

According to Threatpost “It’s unclear how the sites were initially compromised, eSentire said; but, it could have happened via  a vulnerable plugin; or, the WordPress website simply may not have been patched, researchers noted. It’s also possible that attackers infiltrated via an insecure server.

In any event, the sites’ content had been tampered with and added to, while injected with malicious code, starting around December.”

In all cases, each compromised website had up to 100 bogus pages, all with the word “agreement” on them. That was the keyword used to lure unsuspecting victims.

Threatpost expanded on the messaging and said,

“The content also consisted of complete sentences pertaining to the subject of law, placed in random, nonsensical order, according to the posting. When visited by security infrastructure and virtual machines (VMs), these injected gobbledygook blog posts are visible – but when the attackers’ back-end server detects a potential victim, the blog post itself is hidden behind the previously mentioned fake forum posts. Those overlays serve up the malicious links leading to Gootloader.”

How to Avoid Being Attacked by Gootloader

The best way to avoid being affected by Gootloader is not to download any files from the internet that you are not sure of or do not trust the source.

Threatpost warns ‘“If you download a document from the Internet, but you are served a JavaScript file, do not open it,” according to researchers. “Even legitimate Word and Excel documents from the internet can lead to loader malware.”’