WordPress Malware Attacks Using Gootloader

  • By Dawna M. Roberts
  • Published: Mar 11, 2021
  • Last Updated: Mar 18, 2022

 WordPress is one of the most popular website-building platforms, it is also the target for many malicious hacker criminals. Experts warn WordPress site users to immediately update their WordPress installation core files, all plugins, and themes because hackers are using a new type of malware (Gootloader) to perform drive-by and watering-hole attacks.

What is WordPress?

WordPress is one of the world’s most popular CMS (content management system) platforms that developers and end-users employ to build websites, blogs, and e-commerce installations.

WordPress.com claims that 40% of all websites on the internet are built using WordPress. One of the most attractive features of WordPress is that it is free to download, install and use.

WordPress began as a simple platform for blogging but quickly expanded to become a full-fledged website-building tool that Fortune 500 companies as well as mom-and-pop shops use. The platform is well supported with thousands of great themes, plugins, and add-on software to enhance its functionality and features. People without any knowledge of programming or coding can use it to quickly and easily develop a website.

There is also a strong developer network, tutorials, and documentation if you run into trouble.

What Happened?

Threatpost reports that back in December, threat researchers noticed a new type of downloader malware called Gootloader that injects WordPress websites with dozens of pages of fake content. In December, some high-end retail organizations, hotels, music companies, healthcare organizations, educational institutes, and visual arts websites were attacked using Gootloader.

Threatpost stated that ‘“The threat actors’ end game is to infect business professionals, speaking English, German and Korean,” according to  a posting  on the campaign, issued Thursday. “Their modus operandi is to entice a business professional to one of the compromised websites, and then have them click on a link, leading to Gootloader, which attempts to retrieve the final payload, whether it be ransomware, a banking trojan or intrusion tool/credential stealer.”’

The Dangers of Gootloader

Most of the attacks witnessed by researchers involved an employee of a company searching for and downloading a free form or template. When they did, Gootloader was delivered instead. They found several dozen cases in education, medical facilities, and legal firms. Some of these attacks involved ransomware and others a Cobalt Strike.

The researchers responsible for getting the word out, eSentire, found dozens of infected WordPress websites with fake blog pages.

According to Threatpost “It’s unclear how the sites were initially compromised, eSentire said; but, it could have happened via  a vulnerable plugin; or, the WordPress website simply may not have been patched, researchers noted. It’s also possible that attackers infiltrated via an insecure server.

In any event, the sites’ content had been tampered with and added to, while injected with malicious code, starting around December.”

In all cases, each compromised website had up to 100 bogus pages, all with the word “agreement” on them. That was the keyword used to lure unsuspecting victims.

Threatpost expanded on the messaging and said,

“The content also consisted of complete sentences pertaining to the subject of law, placed in random, nonsensical order, according to the posting. When visited by security infrastructure and virtual machines (VMs), these injected gobbledygook blog posts are visible – but when the attackers’ back-end server detects a potential victim, the blog post itself is hidden behind the previously mentioned fake forum posts. Those overlays serve up the malicious links leading to Gootloader.”

How to Avoid Being Attacked by Gootloader

The best way to avoid being affected by Gootloader is not to download any files from the internet that you are not sure of or do not trust the source.

Threatpost warns ‘“If you download a document from the Internet, but you are served a JavaScript file, do not open it,” according to researchers. “Even legitimate Word and Excel documents from the internet can lead to loader malware.”’

About the Author
IDStrong Logo

Related Articles

Instagram Vulnerability Allowed Hackers Access to Control Your Phone

Security experts Check Point Research discovered a critical vulnerability while examining Instagra ... Read More

Alien Malware Infects More than 226 Mobile Apps and Steals Bank Data

As reported on September 24, 2020, by ZDNet and ThreatPost, a new strain of malware named “A ... Read More

Universal Health Systems Hit by Ransomware Attack

Universal Health Systems (UHS), a Fortune 500 company owning more than 400 hospitals across the co ... Read More

Exchange Server Bug Exposes a Big Risk to Hackers

Months after Microsoft released a patch to fix a serious flaw in MS Exchange Server, more than 61% ... Read More

Clients’ Bank Data Exposed in Blackbaud Ransomware Attack

Blackbaud software was victim to a ransomware attack last May, and new information suggests that c ... Read More

Latest Articles

What is Digital Citizenship? Etiquette & Examples

What is Digital Citizenship? Etiquette & Examples

When someone is born on US soil, they are a national citizen; with this distinction, they obtain a list of entitlements and benefits, as well as societal obligations and predetermined consequences for bad behavior.

What Does Incognito Mean, How Does It Work, and Is It Really Safe?

What Does Incognito Mean, How Does It Work, and Is It Really Safe?

How do you browse the Internet? Using a primary browser, you can turn on "incognito mode," which increases your privacy on singular devices but is also less concealing than other privacy tools like virtual private networks (VPNs).

AI Voice Cloning: The New Frontier for Cybercriminal Fraud and How to Protect Yourself

AI Voice Cloning: The New Frontier for Cybercriminal Fraud and How to Protect Yourself

Many members of the younger generations avoid answering phone calls. On the one hand, this avoidance may be personal, as voice calls can sometimes cause anxiety; however, there is more to these rejections than nervousness.

Featured Articles

How to Buy a House with Bad Credit

How to Buy a House with Bad Credit

Buying your own home is the American Dream, but it might seem out of reach to those with bad credit. However, the good news is, if your credit is less than perfect, you do still have options and in most cases, can still buy a home.

How Secure Is Your Password? Tips to Improve Your Password Security

How Secure Is Your Password? Tips to Improve Your Password Security

Any good IT article on computers and network security will address the importance of strong, secure passwords. However, the challenge of good passwords is that most people have a hard time remembering them, so they use simple or obvious ones that pose a security risk.

Top 10 Senior Scams and How to Prevent Them

Top 10 Senior Scams and How to Prevent Them

Senior scams are becoming a major epidemic for two reasons. First, seniors often have a lot of money in the bank from a life of working hard and saving.

Free Identity Exposure Scan
Instantly and Securely Check if Your Personal Information is Exposed on the Dark Web or Sold by Data Brokers
Please enter first name
Please enter last name
Please select a state
Free Identity Threat Scan
Instantly Check if Your Personal Information is Exposed
All fields below are required
Please enter first name
Please enter last name
Please enter a city
Please select a state
Please enter an age
Please enter an email address