- Researchers have spotted a very specific SEO poisoning campaign
- The campaign is dropping a decade-old malware framework
- The end result is either a Cobalt Strike beacon, or ransomware
If you’re an Australian interested in Bengal cats, be very careful when researching the topic online, because you might get hacked.
That’s what cybersecurity researchers from Sophos said in a new report concerning a new SEO poisoning campaign that targets people searching for Bengal cats in Australia.
SEO poisoning is a malicious technique in which cybercriminals manipulate search engine results to push websites under their control to the top of search engine page results. When users open these websites, they are offered malware downloads, or phished for sensitive data.
Limited operation
In this campaign, the crooks were deploying Gootloader, a malware delivery framework used primarily to distribute various types of malware, such as ransomware and information-stealing trojans (like the Gootkit banking trojan). Sophos said they observed Cobalt Strike beacons being dropped, as well as different ransomware strains.
Gootloader has been around for a decade, and so has SEO poisoning. There is nothing out of the ordinary in the method of compromise, or the tools being deployed by the hackers. What stands out is the topic the crooks chose for their distribution – Bengal cats in Australia.
Usually, the crooks would either try to compromise as many computers as possible, or they would go for a specific high-value target, such as a financial institution, or a hospital. SEO poisoning is usually used in the former, to attack a larger cohort such as software developers, cryptocurrency users, or something similar.
In this scenario, the only people who would possibly get infected would be the ones searching “Are Bengal Cats illegal in Australia?”.
One potential reason could be that the crooks were trying to test their SEO poisoning strategies out without drawing too much attention to themselves, therefore choosing the most niche thing they could possibly find.
Via The Register
English