This week, eSentire identified that the “GootLoader” campaign has been targeting the employees of various law and accounting firms in widespread cyberattacks. GootLoader is an initial access malware that, when access is achieved, deploys additional malware, ransomware, or Cobalt Strike onto the infected systems. Researchers detailed, in their report linked below, that this malware utilizes Drive-By-Download campaigns that are enforced through search engine optimization (SEO) via Google. This campaign involves lures to compromised websites that reference business content, such as legal and financial agreements, and offer “free samples” of the professional documents to download. Researchers analyzed four (4) instances of the campaign involving employees of law firms that downloaded fraudulent business agreements titled “Olympus Plea Agreement”, “Postnuptial Agreement Puerto Rico”, and “Model IP Agreement” as well as an employee of an accounting firm that downloaded a fraudulent financial agreement titled “Wayne County Payment Agreement”. CTIX analysts advise that all organizations be vigilant when searching for any type of document sample on the Internet and download content from trustworthy websites.