“Gootkit”, a malware loader utilizing the access-as-a-service (AaaS) model, has recently resurfaced with updated techniques and procedures. Trend Micro researchers detailed its latest infection routine, which involves search engine optimization (SEO) poisoning that leads a victim to clicking on a Gootkit operator-compromised website. Once the victim accesses the website, a legitimate-appearing open forum is shown that directly answers the victim’s initial search query. This forum contains a ZIP archive that holds a malicious JavaScript file that, once downloaded and opened, spawns an obfuscated script that adds encrypted code to the registry via stuffing and configures scheduled tasks to ensure persistence. The code in the registry is then loaded through PowerShell to reconstruct a Cobalt Strike binary that runs in-memory only (i.e. “fileless” execution). While much of the latest infection chain is similar to the attacks that previously occurred in 2020, the following small updates were noted by researchers: first, the search query leverages legal document templates as opposed to freeware installers, and the second is the encrypted code added to the registry now utilizes a custom text replacement algorithm rather than base64 encoding. The small changes indicate that “Gootkit Loader is still actively being developed and has proved successful in compromising unsuspecting victims.” The researchers also explained that, as of late July, the analyzed website is no longer accessible, which is expected with SEO poisoning. An in-depth analysis of the Gootkit loader as well as indicators of compromise can be viewed in Trend Micro’s report linked below.