GootLoader and SocGholish Dual Campaign Against Six Law Firms (2023)

What happened

eSentire's Threat Response Unit (TRU) reported that it shut down 10 cyberattacks hitting six different law firms throughout January and February 2023. The activity came from two separate campaigns. One delivered GootLoader through black-hat SEO poisoning of compromised WordPress sites carrying fake legal agreement content. The second, which eSentire places in January, delivered SocGholish (FakeUpdates) through a watering-hole compromise of a Notary Public website in the Miami area, and it hit law firm employees and other business professionals alike rather than only the six firms. Law firms were not a new target for the GootLoader operation: TRU had detected two previous campaigns against law firm employees, one in January 2022 and a second in June 2022.

eSentire published its findings on February 28, 2023. It reported that no ransomware was deployed, and that this had already been the pattern through 2022, which TRU flagged as a possible shift toward espionage and exfiltration motives.

How it worked

Two independent, technically distinct infection chains ran in parallel against the same target vertical, law firm employees.

GootLoader chain: attackers used black-hat SEO poisoning to get legitimate but compromised WordPress sites, hacked without the site owners' knowledge, to rank highly for niche legal search terms such as "agreement," "contract," or "contract salary calculator," phrases with so little SEO competition for that particular collection of words that a single poisoned blog post could climb into the top five search results. An employee searching for a template would click through to what looked like an online forum thread answering their exact question, offering an alleged agreement or contract template. In eSentire's words, "when the employee downloads and executes the document, they are actually downloading and executing the GootLoader malware." eSentire did not describe the file type or archive delivered in these particular intrusions. What it did report about escalation is that since 2022 it has observed GootLoader dropping IcedID and escalating to hands-on intrusions by the threat actors. A separate eSentire case from January 12, 2023, involving a different customer, records one such intrusion in detail: approximately two hours after infection, an operator deployed Cobalt Strike through the existing PowerShell process, ran BloodHound against Active Directory, and tried to move laterally with PsExec.

SocGholish/FakeUpdates chain: attackers compromised a legitimate Notary Public website in the Miami metropolitan area that legal professionals routinely visited, possibly via a WordPress vulnerability, according to eSentire, and added a page displaying a convincing fake "Chrome browser update is required" alert to which home-page visitors were redirected. A visitor who went to update the browser downloaded SocGholish instead. eSentire describes SocGholish as a loader that performs reconnaissance and deploys secondary payloads including Cobalt Strike, typically operated by initial access brokers, and notes that the LockBit ransomware operation had recently been observed using it. eSentire reports no such follow-on for this case set. The victim profile here is a byproduct of scale rather than selection: infecting a large number of lower-traffic sites occasionally yields a high-value one, and the Notary Public site happened to be frequented by legal firms.

The lure and the tell

The lure worked because it hijacked two forms of implicit trust legal professionals rely on daily: trust in search engine rankings, since a top-five result for "contract salary calculator" or an agreement template reads as authoritative, and trust in a routine professional resource, in this case a Notary Public site legal staff already visited.

The GootLoader tell that the evidence supports is the source, not the file. A document offered by a forum thread found through a search is not a document from a source the firm trusts, and eSentire's user-facing recommendation for this campaign says exactly that: "Don't trust documents posted on random forums. Have a process for employees to download documents from trusted sources only." Extension-spotting is a weaker tell than it looks. Windows hides extensions for known file types by default, which is why eSentire lists turning them on as a control in the same report, and eSentire warns in that same list that "even legitimate Word and Excel documents from the Internet can lead to malware," so a document-looking file would not have been a safe outcome either.

The SocGholish tell is cleaner: a genuine Chrome update never originates from a website's own content or overlay, since it comes from the browser itself (chrome://settings/help). The fake prompt was styled convincingly enough to pass casual inspection, especially for non-technical legal staff.

Outcome

eSentire says it shut down 10 cyberattacks across the six firms, and reports no ransomware deployment. Its own account is narrower than a clean pre-execution block: TRU "responded to multiple incidents involving several law firm customers and, in all cases, the victims searched for document templates," and its researcher's assessment turns on the campaign "maintaining success in infecting legal firms." Infections occurred and were responded to. No breach, exfiltration, or loss figure was disclosed for this incident set, and no firm was named.

The absence of ransomware was not a departure in this campaign, it was a continuation. eSentire reported that throughout 2022, GootLoader infections continued to escalate to hands-on intrusions with "no ransomware has been observed even when intruders are allowed nearly free reign," and that only Collection was observed in those cases. Keegan Keplinger, senior threat intelligence researcher with TRU, framed the inference this way: "TRU observed that the GootLoader attacks in 2022 and those in January and February are not leading to Ransomware malware, which is curious. The increased absence of Ransomware being deployed in these attacks, while maintaining success in infecting legal firms, and a willingness to engage in hands-on intrusions, suggests the possibility that the GootLoader operations have shifted to not only supporting financially-motivated attacks but also supporting politically-motivated and cyber espionage operations." The espionage reading rests on that run of no-ransomware, hands-on intrusions across 2022 and into early 2023, not on these ten attacks alone.

Why it matters

This case is a clean, well-documented example of two of the most prevalent "living off the land"/social-engineering-adjacent delivery vectors, SEO poisoning and fake browser-update watering holes, being used together against a single high-value vertical. Law firms handle sensitive client, M&A, and litigation data, making them attractive espionage and extortion targets, and eSentire records law firm employees as the target of two earlier GootLoader campaigns in 2022 as well. It illustrates that initial-access brokers do not need phishing emails at all: abusing search-engine trust and a routinely-visited legitimate third-party site was enough to reach the intended victims. It also demonstrates why "was this a legitimate browser update or search result" needs to be part of end-user security training for professional-services staff, and it shows a security vendor's account of attacks it shut down rather than a breach post-mortem, useful for illustrating that these techniques are common enough to appear as routine SOC work across multiple same-industry clients in a two-month window.

Defenses

eSentire's TRU and 24/7 SOC say they shut down all 10 attacks, though eSentire published no detection-to-containment time for this set, and the host isolation and command-and-control blocklisting it describes belong to a separate January 12, 2023 GootLoader intrusion at a different customer. Controls that address this vector, several of them eSentire's own recommendations in the same report: a trusted internal repository for document templates, so employees have no reason to pull one from a search result; web-filtering and DNS blocking of newly-registered or reputation-poor domains; Windows Attack Surface Reduction rules blocking JavaScript and VBScript from launching downloaded content; displaying file extensions for known file types, which eSentire recommends as a system setting to change rather than as something users can be expected to notice unaided; EDR rules flagging script interpreters such as wscript.exe or mshta.exe spawned from browser downloads; user training that legitimate browser updates never come from a website pop-up; and monitoring for anomalous PowerShell and outbound beaconing consistent with Cobalt Strike staging, which is how eSentire caught the January 12 intrusion. Speed is the binding constraint, since eSentire reports having observed SocGholish drop Cobalt Strike within 10 minutes, and a GootLoader infection reach hands-on-keyboard activity in about two hours.