Search engine deoptimization with Gootloader

The talk looks at Gootloader, a web-based distribution campaign that uses manipulated search results to push follow-on malware such as Gootkit and banking trojans. The speakers explain the preparation stage first: attackers compromise many WordPress sites and inject code that filters visitors by country, referrer and repeat address. Poisoned search terms, mostly business words like contracts, agreements and downloads, are tuned per language, and the top-ranked result swaps the page for a fake forum thread that offers a file named after the query.

The middle of the talk follows the infection chain. A heavily obfuscated JavaScript dropper fetches a second-stage installer, which checks whether the host is joined to a Windows domain before storing payloads and a PowerShell loader in the registry and an autorun value. The loader then uses process hollowing to run the final payload inside a legitimate, signed Windows binary, so very little is written to the file system. The speakers also describe a one-line remote shell injected into compromised sites and telemetry that points to roughly 90 to 100 compromised servers, with likely many more.

For defenders, the talk argues that end users have few practical protections: script blockers, recognising the recurring fake forum layout, typing addresses directly and showing file extensions all help but depend on user behaviour. The speakers place much of the responsibility on search providers to detect this kind of manipulation, and they point to behaviour-based endpoint detection as the most realistic control against the fileless persistence.