Don't search for information on cats at work — you could be at risk of being hacked

(Image credit: Unsplash)

Researchers have spotted a very specific SEO poisoning campaign
The campaign is dropping a decade-old malware framework
The end result is either a Cobalt Strike beacon, or ransomware

If you’re an Australian interested in Bengal cats, be very careful when researching the topic online, because you might get hacked.

That’s what cybersecurity researchers from Sophos said in a new report concerning a new SEO poisoning campaign that targets people searching for Bengal cats in Australia.

SEO poisoning is a malicious technique in which cybercriminals manipulate search engine results to push websites under their control to the top of search engine page results. When users open these websites, they are offered malware downloads, or phished for sensitive data.

Limited operation

In this campaign, the crooks were deploying Gootloader, a malware delivery framework used primarily to distribute various types of malware, such as ransomware and information-stealing trojans (like the Gootkit banking trojan). Sophos said they observed Cobalt Strike beacons being dropped, as well as different ransomware strains.

Gootloader has been around for a decade, and so has SEO poisoning. There is nothing out of the ordinary in the method of compromise, or the tools being deployed by the hackers. What stands out is the topic the crooks chose for their distribution - Bengal cats in Australia.

Usually, the crooks would either try to compromise as many computers as possible, or they would go for a specific high-value target, such as a financial institution, or a hospital. SEO poisoning is usually used in the former, to attack a larger cohort such as software developers, cryptocurrency users, or something similar.

In this scenario, the only people who would possibly get infected would be the ones searching “Are Bengal Cats illegal in Australia?”.

One potential reason could be that the crooks were trying to test their SEO poisoning strategies out without drawing too much attention to themselves, therefore choosing the most niche thing they could possibly find.

Via The Register

SEO poisoning and VPN spoofing used to target anything and everything with WikiLoader malware
Here's a list of the best firewalls today
These are the best endpoint protection tools right now

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.