Threat Research – Sophos News
Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” 21 January 2025 at 05:30

Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing”

21 January 2025 at 05:30

Sophos MDR identifies a new threat cluster riffing on the playbook of Storm-1811, and amped-up activity from the original connected to Black Basta ransomware.

A screenshot of Python code from an obfuscated copy of RPivot dropped by the STAC5143 attackers.

Figure 2:Sophos Central investigation screen of threat actor’s incoming activity captured by Microsoft Office 365 integration

Threat Research – Sophos News
Gootloader inside out 16 January 2025 at 11:00

Gootloader inside out

Threat Research – Sophos News

By:Gabor Szappanos

16 January 2025 at 11:00

Open-source intelligence reveals the server-side code of this pernicious SEO-driven malware - without needing a lawyer afterward

A list of Gootloader JScript filenames, which correspond to the search query that led victims to download them

Gootloader has poisoned search results in multiple languages, including German, French, and Korean

Source of the Gootkit/Gootloader landing pages reveal a number of different search terms and phrases the threat actors wanted search engines to index. The linked subpages (selected with green) don't actually exist. The injected WordPress code defines a few hooks, one of them is for non-existing pages. This will serve the fake forum discussion, when the victim clicks on the search result

A screenshot of the source code from a Gootkit/Goodloader landing page. Image courtesy of Sucuri Research.

The WordPress database dump included this table that contains a set of the first three octets of IP addresses, a block list of IP ranges that cannot revisit the Gootloader website on the same day

A block of base64-encoded data stored as a variable named $pposte in a WordPress database

Malicious SEO content phrases embedded in a WordPress database table, linking the site to an Excel spreadsheet converter search query

The "place marker" string appears in the OpenGraph metadata SEO headers of a Gootkit/Gootloader-modified web page

Files that contain references to the Gootloader "mothership" website (screenshot courtesy of VirusTotal)

Commented text, preceded with double slashes, documents the Gootkit characteristics of modified web pages

A SQL dump from a compromised WordPress installation contains base64-encoded elements of the Gootkit/Gootloader modifications

The decoded base64 data from the WordPress database reveals the PHP script that handles decoding the malicious content for a site visitor

A simple command shell Gootkit inserts into the PHP running in a WordPress site the threat actors have comrpomised

The portion of the Gootkit code that collects the HTML content of the fake page it will later draw over the top of the compromised website

The Gootkit code blocks repeat visitors by adding not only the visitor's IP address range to a block list, but the entire class C IPv4 address range on either side of the visitor's address, just for good measure

The Gootkit/Gootloader fake forum page, featuring a "question" and an "answer" that links to the Gootloader JScript first-stage payload

The unique key is linked in a Javascript code snippet embedded in the compromised WordPress server page.

A set of commands that deletes from view the original page content on the compromised WordPress server page the visitor lands on

The replacement content includes the text of the "Questions And Answers" fake forum page

The download link points to a php script hosted on a different server. This link delivers the .js file packed into a Zip archive which comprises the first stage Gootloader payload

A Gootkit/Gootloader fake forum page in German. The source code of the page shows the link points to a file named down.php hosted on a completely different server than the one where the page appears. The link marked in red will connect to the server that is hosting the first-stage download JScript.

The source code of the PHP script that delivers the first stage Gootloader payload

Screenshot of the modified HelloDolly.php script (courtesy of the Rich Infante blog)

Another format of the modified HelloDolly.php script shows the unique identifier string

A variation on the modified HelloDolly.php script

A screenshot that summarizes the modification process Gootloader uses (image courtesy of the Rich Infante blog)

A WordPress database dump contains the same elements that the Rich Infante blog references

The encoded form of a PHP script that delivers the .js payload

A screenshot of a file uploaded to VirusTotal shows references to the IP address formerly used to host the Gootkit/Gootloader "mothership" server

The my-game website as it appeared in 2014, a Russian-language gambling site called "Casino Game Life"

The my-game domain that continues to host the Gootkit/Gootloader mothership originally belonged to a German team that played the game Counter-Strike competitively

Threat Research – Sophos News
159-CVE January Patch Tuesday smashes single-month record 14 January 2025 at 21:09

159-CVE January Patch Tuesday smashes single-month record

Threat Research – Sophos News

By:Angela Gunn

14 January 2025 at 21:09

Brace yourselves... and consider reading your email in plaintext for now

A bar chart showing the distribution of severities of bugs patched in the January 2025 Patch Tuesday set, as described in the article text

A bar chart showing the distribution of product families affected by bugs patched in the January 2025 Patch Tuesday set, as described in the article text

A bar chart showing 61 months of overall CVEs counts for Microsoft Patch Tuesdays since January 2020; the rightmost bar indicates the numbers for january 2025 and is taller than the rest

Threat Research – Sophos News
Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks 30 December 2024 at 09:05

Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks

Threat Research – Sophos News

By:Matt Wixey

30 December 2024 at 09:05

In the second of a two-part series on tools and frameworks designed to help with remediation prioritization, we explore some alternatives to CVSS

Threat Research – Sophos News
Prioritizing patching: A deep dive into frameworks and tools – Part 1: CVSS 27 December 2024 at 11:33

Prioritizing patching: A deep dive into frameworks and tools – Part 1: CVSS

Threat Research – Sophos News

By:Matt Wixey

27 December 2024 at 11:33

In the first of a two-part series exploring tools and frameworks which can help organizations with remediation prioritization, Sophos X-Ops takes a look at the Common Vulnerability Scoring System (CVSS)