GootLoader operators hijacked Google search rankings for legal-agreement phrases, luring law firm staff to fake forum "direct download" pages that delivered malicious JavaScript loaders, some of which escalated via Cobalt Strike into REvil ransomware attacks, a pattern CFC's Incident Response Team documented after seeing it hit multiple insured legal services firms.
Social Engineering Examples·6 sources
In 2021, CFC's Incident Response Team warned that it had "recently seen several ransomware attacks on legal services firms" traced back to GootLoader malware. The attackers used SEO poisoning to push compromised, unrelated websites to the top of Google search results for specific legal-agreement phrases. Victims clicking through landed on pages disguised as forum posts offering a "direct download." The download was a ZIP file containing a JavaScript file named after the search term; executing it installed GootLoader, which could pull down further tools, including Cobalt Strike modules, to stage a ransomware attack. CFC also reported that some compromised sites distributing GootLoader were law firm websites. Other vendors separately tracked GootLoader activity, including Mandiant's UNC2565 attribution and later Cybereason reporting.
GootLoader's operators (tracked by Mandiant as UNC2565) used malicious SEO ("SEO poisoning") to force compromised WordPress and other third-party websites, including hacked law firm sites per CFC, to rank at or near the top of Google results for narrow, low-competition legal phrases, especially those containing the word "agreement" (e.g., "the Canadian inter-company arbitration agreement"). A visitor searching that exact phrase would see a result whose site had nothing to do with law (CFC's example was a marketing company's site) but whose page had been seeded with content matching the query. Clicking through landed the visitor on a page styled as a forum post that appeared to directly answer the question with a "direct download" link. That link served a ZIP archive containing a JavaScript (.js) file named after the search term, so it looked like the legal document/template the user wanted. Double-clicking the .js file executed it via Windows Script Host, installing GootLoader, which then could fetch further payloads, commonly Cobalt Strike modules, to stage a full ransomware intrusion. CFC and Sophos both tied the loader's downstream activity to REvil/Sodinokibi ransomware in observed cases. CFC's incident responders also documented a watering-hole variant of the same infrastructure: compromised law firm websites were themselves used to serve GootLoader to other law firms whose staff visited them, extending the campaign within the legal sector.
The lure was a Google search result for an exact, ordinary-sounding legal phrase (CFC's own example: "the Canadian inter-company arbitration agreement") that appeared to lead straight to the document being sought, via a forum post promising a "direct download." The tell: the top-ranking site's stated business (e.g., a marketing firm) had no plausible connection to legal documents; the page required a file download to reveal an "answer" rather than just displaying text; and the surrounding page copy was often grammatically awkward because it had been engineered/stuffed to match the search query rather than written naturally. These were three checks CFC explicitly told clients to run before trusting any such download.
CFC reported that its Incident Response Team had "recently seen several ransomware attacks on legal services firms" apparently caused by GootLoader, and separately observed law firm websites used to distribute GootLoader to other visiting law firms. Arete Analysis separately documented a watering-hole incident in which a fraudulent forum delivered GootLoader and the compromise led to REvil activity through Cobalt Strike. eSentire separately documented continued legal-services targeting in January 2022, while Mandiant continued tracking GootLoader infrastructure attributed to UNC2565 through at least January 2023. Cybereason investigated a later GootLoader wave.
This case is a clean, well-documented example of watering-hole/SEO-poisoning social engineering that exploits professional trust in search rankings rather than tricking a specific individual with a crafted message. It shows how attackers can weaponize an entire professional community's routine behavior (lawyers searching for standard agreement templates) by manipulating the search layer itself, and how a single compromised niche website can become reusable attack infrastructure against peers in the same industry (law firm to law firm). It also illustrates the classic loader-to-ransomware pipeline: a seemingly minor JS-file execution provided a foothold that, per CFC and Sophos, escalated via Cobalt Strike into full REvil ransomware intrusions, underscoring why an initial "just a file download" moment is actually the highest-leverage point to stop a ransomware kill chain.
CFC's advisory recommended: sense-checking downloads (does the site's topic actually match the search term; is a download required to get an "answer"; does the page read grammatically odd); keeping anti-virus/anti-malware auto-updating with regular scans; keeping OS and applications patched/auto-updated; deploying a secure web gateway to flag malicious sites; using application allow-listing/device management to block execution of untrusted executables and scripts; and user awareness training on this specific lure pattern. Broader industry advisories (Sophos, Mandiant, eSentire, Cybereason) additionally recommend blocking execution of JavaScript/WSH files downloaded from the browser, monitoring for anomalous wscript.exe/PowerShell activity, and EDR detection of Cobalt Strike beacon indicators as a second line of defense once initial execution occurs.
Social Engineering Examples. “GootLoader SEO Poisoning of Legal Services Firms”. Accessed 3 November 2026. https://socialengineeringexamples.com/gootloader-seo-poisoning-legal-services-2021
Per Sophos, GootLoader operators (tracked by Mandiant as UNC2565) maintained a network of roughly 400 compromised, otherwise-legitimate third-party websites, frequently WordPress sites and, per CFC, including hacked law firm sites, and identified narrow, low-competition legal search phrases (queries containing the word "agreement") that real professionals routinely search for and that have little existing content to outrank.
A targeted organization has no direct control over which third-party sites elsewhere on the internet get compromised and folded into this infrastructure, so this stage is not realistically defensible at the victim-org level; the practical control point shifts to the moment an employee actually encounters and clicks a poisoned result (see Stage 3).
Operators seeded the compromised sites with fake forum-style pages engineered to repeat the target search phrase verbatim, so Google's ranking algorithm would surface the page as a directly relevant, seemingly organic top result for that exact query.
Detecting and deindexing manipulated search content is primarily a search-engine responsibility rather than a control available to the targeted organization; defenders instead lean on secure web gateways and threat-intelligence feeds (per CFC's and the broader vendor advisories' recommendations) to flag known malicious or compromised domains before an employee's click reaches them.
A law firm employee searching for a common legal-agreement template or document clicked the top-ranking but attacker-controlled search result, typically without noticing that the site's actual stated business (e.g., a marketing firm) had no connection to the legal term searched.
User awareness training, specifically on CFC's sense-check of whether a site's stated business actually matches the search topic before clicking through, directly targets this decision point.
The landing page was disguised as a forum post that appeared to directly answer the visitor's exact question, using matching wording to build instant credibility and present a "direct download" link as the fastest path to the wanted document.
Training staff to recognize CFC's published tells, a page that requires a file download to reveal an "answer," and copy that reads grammatically awkward because it was stuffed to match the search term rather than written naturally, undercuts the social-proof effect of the fake forum page.
Clicking "direct download" served a ZIP archive containing a JavaScript (.js) file named after the search term, disguising it as the legal document or template the user believed they were retrieving.
A secure web gateway or network-level content filtering can block delivery of executable or script content from flagged sites, and mail/web security tooling can flag ZIP archives that contain script files as a class.
The victim double-clicked the .js file, which Windows Script Host executed, installing GootLoader on the endpoint as the attackers' initial foothold.
Application allow-listing and device management (per CFC), combined with Windows Attack Surface Reduction rules to block JavaScript/VBScript files launched from downloaded content (per eSentire), stop the .js file from executing even if it reaches the endpoint.
GootLoader called out to attacker-controlled infrastructure to fetch further tools, notably Cobalt Strike modules (per CFC and Sophos) or, in Mandiant's later-tracked variants, FONELAUNCH and Cobalt Strike BEACON, giving a human operator hands-on-keyboard access to the network.
EDR detection of Cobalt Strike beacon indicators and monitoring for anomalous wscript.exe/PowerShell activity, recommended across the Sophos, Mandiant, eSentire, and Cybereason advisories, gives defenders a second chance to catch and contain the intrusion before further lateral movement.
In cases documented by CFC and Sophos, the Cobalt Strike foothold was used to stage and deploy REvil/Sodinokibi ransomware across the compromised network, completing the attackers' financially motivated extortion objective.
Offline or immutable backups, network segmentation to limit lateral spread, and a tested incident-response/ransomware-containment plan reduce the odds that a successful loader execution culminates in full-network ransomware impact and extortion.
Browse by what this case has in common with others in the library.
Gootloader went quiet in the spring of 2025, the tracking researcher telling BleepingComputer his abuse reports caused the operation to…
eSentire's Threat Response Unit says it shut down 10 attacks on six unnamed law firms across January and February 2023,…
A Ukrainian-language "shared document" phishing wave used a fake reCAPTCHA "verify you are human" ClickFix page to trick victims into…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the…
A Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a…
A deepfaked Martin Lewis Facebook ad led to a fake adviser, a Revolut account, £5,000 of savings and £70,000 in…
eSentire's Threat Response Unit says it shut down 10 attacks on six unnamed law firms across January and February 2023,…
A Houston- and California-based ring spoofed or compromised business emails to trick four companies and one New Jersey township into…
Target's 2013 breach began with malware emailed to a small HVAC contractor. 40M cards and 70M records exposed. What's known,…
An Austin man lost $1,408,850 to a fake DAIQ crypto platform found on LINE. A staged $40,000 handoff led police…
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push…
Posing as NatWest bank security, vishing criminals convinced a Surrey solicitor to transfer £734,000 of client money to "safe" accounts.…
In March 2022, LAPSUS$ (DEV-0537) leaked an archive it said held 37GB of Microsoft source code. Microsoft only confirmed that…
DOJ/FTC alleged that Citizens Disability and subsidiary CD Media made 109 million-plus illegal telemarketing calls, including 25.7 million-plus to Do-Not-Call…
MGM Resorts, September 2023. A caller reportedly talked the IT help desk into resetting an employee's access, and the shutdown…
Social Engineering Examples