Hi everyone, it's Andrew 🌻 Brandt 🐇 (npub1nze…spjz) driving the X-Ops social media today to let you know about a story we just published, written by my colleague Gabor Szappanos.
Szapi has done significant research in the past into a #malware family called #Gootloader that (for years, now) uses malicious #SEO techniques to promote compromised websites into Google search results.
This research finally cracks wide open the mystery of how they manage to do that so effectively. It's a long read, but well worth the deep dive.
https://news.sophos.com/en-us/2025/01/16/gootloader-inside-out/
1/
Sophos X-Ops
npub1xr…hfkxn
2025-01-16 17:00:38 UTC
Author Public Key
npub1xrhn2zk0fhcxz8gtaggj0hfmvgm0j4v5n2c2yhjssu22tqmxnmgslhfkxnSeen on
wss://relay.momostr.pinkPublished at
2025-01-16 17:00:38 UTCEvent JSON
{
"id": "98109f37d9e7fe9be201f0ee97d31179cbb8eb8d7716eb4458545b2b90d39914",
"pubkey": "30ef350acf4df0611d0bea1127dd3b6236f955949ab0a25e508714a583669ed1",
"created_at": 1737046838,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@SophosXOps/113839101605714016",
"web"
],
[
"t",
"malware"
],
[
"t",
"gootloader"
],
[
"p",
"98b26073ee87a66d1c56267d6a3a068a11f60d5c87abf95ddfa64fd38961eb84"
],
[
"t",
"seo"
],
[
"proxy",
"https://infosec.exchange/users/SophosXOps/statuses/113839101605714016",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/SophosXOps/statuses/113839101605714016",
"pink.momostr"
],
[
"-"
]
],
"content": "Hi everyone, it's nostr:npub1nzexqulws7nx68zkye7k5wsx3gglvr2us74ljhwl5e8a8ztpawzqz8spjz driving the X-Ops social media today to let you know about a story we just published, written by my colleague Gabor Szappanos.\n\nSzapi has done significant research in the past into a #malware family called #Gootloader that (for years, now) uses malicious #SEO techniques to promote compromised websites into Google search results.\n\nThis research finally cracks wide open the mystery of how they manage to do that so effectively. It's a long read, but well worth the deep dive.\n\nhttps://news.sophos.com/en-us/2025/01/16/gootloader-inside-out/ \n\n1/",
"sig": "5701220fc8199f8a00e4391cdec65ebc597191d8bba01807d41c5e96a78895d7df949f4fcedcd74563081d2c36ad1f06af79f3039437346b0f64a6b25bacf188"
}