Don’t search for information on cats at work — you could be at risk of being hacked

• Researchers have spotted a very specific SEO poisoning campaign
• The campaign is dropping a decade-old malware framework
• The end result is either a Cobalt Strike beacon, or ransomware

If you’re an Australian interested in Bengal cats, be very careful when researching the topic online, because you might get hacked.

That’s what cybersecurity researchers from Sophos said in a new report concerning a new SEO poisoning campaign that targets people searching for Bengal cats in Australia.

SEO poisoning is a malicious technique in which cybercriminals manipulate search engine results to push websites under their control to the top of search engine page results. When users open these websites, they are offered malware downloads, or phished for sensitive data.

Limited operation

In this campaign, the crooks were deploying Gootloader, a malware delivery framework used primarily to distribute various types of malware, such as ransomware and information-stealing trojans (like the Gootkit banking trojan). Sophos said they observed Cobalt Strike beacons being dropped, as well as different ransomware strains.

Gootloader has been around for a decade, and so has SEO poisoning. There is nothing out of the ordinary in the method of compromise, or the tools being deployed by the hackers. What stands out is the topic the crooks chose for their distribution – Bengal cats in Australia.

Usually, the crooks would either try to compromise as many computers as possible, or they would go for a specific high-value target, such as a financial institution, or a hospital. SEO poisoning is usually used in the former, to attack a larger cohort such as software developers, cryptocurrency users, or something…