Menlo Security, a web security vendor headquartered in California, recently identified two active campaigns with one utilizing REvil ransomware and one dropping the SolarMarker backdoor. In their report, linked below, researchers explained that the two campaigns, dubbed “Gootloader” and “SolarMarker”, are using SEO poisoning (AKA “search poisoning”) as their attack method, which “relies on optimizing websites using ‘black hat’ SEO techniques to rank higher in Google search results”. The actors behind the two campaigns “inject sites with keywords that cover over 2,000 unique search terms” and, once one of the optimized websites that appears as a PDF is clicked, the user is prompted to download the fraudulent document. If the user accepts the download, they are redirected to other sites that drop the campaign-specified malware payload onto their machine (Gootloader drops the REvil ransomware and SolarMarker drops the SolarMarker backdoor). The redirecting technique was implemented in order to prevent the campaigns’ malicious content from being detected and removed from the search results. The websites involved, however, were not created by the actors but are WordPress websites that were compromised by “an undisclosed flaw in the ‘Formidable Forms’ WordPress plugin” via the “/wp-content/uploads/formidable/” folder. Menlo Security determined that the following are the top five industry types that are related to the compromised websites utilized: Business, Non-profits/NGOs, Health and Medicine, Shopping, and Education. CTAPT is following the Gootloader and SolarMarker campaigns and will monitor for future development.