{"id":4603,"date":"2022-02-27T19:56:49","date_gmt":"2022-02-27T18:56:49","guid":{"rendered":"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up"},"modified":"2022-02-27T19:56:49","modified_gmt":"2022-02-27T18:56:49","slug":"gootloader-infection-cleaned-up","status":"publish","type":"post","link":"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up","title":{"rendered":"Gootloader infection cleaned up"},"content":{"rendered":"<p>Dear blog owner and visitors,<\/p>\n<p>This blog <u>had been<\/u> infected to serve up Gootloader malware to Google search victims, via a common tactic known as SEO (Search Engine Optimization) poisioning. Your blog was serving up <b>337<\/b> malicious pages. Your blogged served up malware to <b>168<\/b> visitors.<\/p>\n<p>I tried my best to clean up the infection, but I would do the following:<\/p>\n<ul>\n<li>Upgrade WordPress to the latest version (one way the attackers might have gained access to your server)<\/li>\n<li>Upgrade all WordPress themes to the latest versions (another way the attackers might have gained access to your server)<\/li>\n<li>Upgrade all WordPress plugins (another way the attackers might have gained access to your server), and remove any unnecessary plugins.<\/li>\n<li>Verify all users are valid (in case the attackers left a backup account, to get back in)<\/li>\n<li>Change all passwords (for WordPress accounts, FTP, SSH, database, etc.) and keys. This is probably how the attackers got in, as they are known to brute force weak passwords<\/li>\n<li>Run antivirus scans on your server<\/li>\n<li>Block these IPs (5.8.18.7 and 89.238.176.151), either in your firewall, .htaccess file, or in your \/etc\/hosts file, as these are the attackers command and control servers, which send malicious commands for your blog to execute<\/li>\n<li>Check cronjobs (both server and WordPress), aka scheduled tasks. This is a common method that an attacker will use to get back in. If you are not sure, what this is, Google it<\/li>\n<li>Consider wiping the server completly, as you do not know how deep the infection is. If you decide not to, I recommend installing some security plugins for WordPress, to try and scan for any remaining malicious files. Integrity Checker, WordPress Core Integrity Checker, Sucuri Security,<br \/>\nand Wordfence Security, all do some level of detection, but not 100% guaranteed<\/li>\n<li>Go through the process for Google to recrawl your site, to remove the malcious links (to see what malicious pages there were, Go to Google and search site:your_site.com agreement)<\/li>\n<li>Check subdomains, to see if they were infected as well<\/li>\n<li>Check file permissions<\/li>\n<\/ul>\n<p>Gootloader (previously Gootkit) malware has been around since 2014, and is used to initally infect a system, and then sell that access off to other attackers, who then usually deploy additional malware, to include ransomware and banking trojans. By cleaning up your blog, it will make a dent in how they infect victims. <b>PLEASE<\/b> try to keep it up-to-date and secure, so this does not happen again.<\/p>\n<p>Sincerly,<\/p>\n<p>The Internet Janitor<\/p>\n<p>Below are some links to research\/further explaination on Gootloader:<\/p>\n<p><a href='https:\/\/news.sophos.com\/en-us\/2021\/03\/01\/gootloader-expands-its-payload-delivery-options\/'>https:\/\/news.sophos.com\/en-us\/2021\/03\/01\/gootloader-expands-its-payload-delivery-options\/<\/a><\/p>\n<p><a href='https:\/\/news.sophos.com\/en-us\/2021\/08\/12\/gootloaders-mothership-controls-malicious-content\/'>https:\/\/news.sophos.com\/en-us\/2021\/08\/12\/gootloaders-mothership-controls-malicious-content\/<\/a><\/p>\n<p><a href='https:\/\/www.richinfante.com\/2020\/04\/12\/reverse-engineering-dolly-wordpress-malware'>https:\/\/www.richinfante.com\/2020\/04\/12\/reverse-engineering-dolly-wordpress-malware<\/a><\/p>\n<p><a href='https:\/\/blog.sucuri.net\/2018\/12\/clever-seo-spam-injection.html'>https:\/\/blog.sucuri.net\/2018\/12\/clever-seo-spam-injection.html<\/a><\/p>\n<p><a href='gootloader.html'>This message<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dear blog owner and visitors, This blog had been infected to serve up Gootloader malware to Google search victims, via a common tactic known as SEO (Search Engine Optimization) poisioning. Your blog was serving up 337 malicious pages. Your blogged served up malware to 168 visitors. I tried my best to clean up the infection, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[1],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Gootloader infection cleaned up - Leren snowboarden bij Tasha&#039;s Snowcamp<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up\" \/>\n<meta property=\"og:locale\" content=\"nl_NL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Gootloader infection cleaned up - Leren snowboarden bij Tasha&#039;s Snowcamp\" \/>\n<meta property=\"og:description\" content=\"Dear blog owner and visitors, This blog had been infected to serve up Gootloader malware to Google search victims, via a common tactic known as SEO (Search Engine Optimization) poisioning. Your blog was serving up 337 malicious pages. Your blogged served up malware to 168 visitors. I tried my best to clean up the infection, [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up\" \/>\n<meta property=\"og:site_name\" content=\"Leren snowboarden bij Tasha&#039;s Snowcamp\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/SurfcampScheveningen\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-27T18:56:49+00:00\" \/>\n<meta name=\"twitter:label1\" content=\"Geschreven door\" \/>\n\t<meta name=\"twitter:data1\" content=\"\" \/>\n\t<meta name=\"twitter:label2\" content=\"Geschatte leestijd\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up\",\"url\":\"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up\",\"name\":\"Gootloader infection cleaned up - Leren snowboarden bij Tasha's Snowcamp\",\"isPartOf\":{\"@id\":\"https:\/\/lerensnowboarden.com\/#website\"},\"datePublished\":\"2022-02-27T18:56:49+00:00\",\"dateModified\":\"2022-02-27T18:56:49+00:00\",\"author\":{\"@id\":\"\"},\"breadcrumb\":{\"@id\":\"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up#breadcrumb\"},\"inLanguage\":\"nl-NL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/lerensnowboarden.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Gootloader infection cleaned up\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/lerensnowboarden.com\/#website\",\"url\":\"https:\/\/lerensnowboarden.com\/\",\"name\":\"Leren snowboarden bij Tasha's Snowcamp\",\"description\":\"Snowboardles in Den Haag\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/lerensnowboarden.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"nl-NL\"},{\"@type\":\"Person\",\"@id\":\"\",\"url\":\"https:\/\/lerensnowboarden.com\/author\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Gootloader infection cleaned up - Leren snowboarden bij Tasha's Snowcamp","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up","og_locale":"nl_NL","og_type":"article","og_title":"Gootloader infection cleaned up - Leren snowboarden bij Tasha's Snowcamp","og_description":"Dear blog owner and visitors, This blog had been infected to serve up Gootloader malware to Google search victims, via a common tactic known as SEO (Search Engine Optimization) poisioning. Your blog was serving up 337 malicious pages. Your blogged served up malware to 168 visitors. I tried my best to clean up the infection, [&hellip;]","og_url":"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up","og_site_name":"Leren snowboarden bij Tasha's Snowcamp","article_publisher":"https:\/\/www.facebook.com\/SurfcampScheveningen","article_published_time":"2022-02-27T18:56:49+00:00","twitter_misc":{"Geschreven door":"","Geschatte leestijd":"2 minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up","url":"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up","name":"Gootloader infection cleaned up - Leren snowboarden bij Tasha's Snowcamp","isPartOf":{"@id":"https:\/\/lerensnowboarden.com\/#website"},"datePublished":"2022-02-27T18:56:49+00:00","dateModified":"2022-02-27T18:56:49+00:00","author":{"@id":""},"breadcrumb":{"@id":"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up#breadcrumb"},"inLanguage":"nl-NL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/lerensnowboarden.com\/gootloader-infection-cleaned-up#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/lerensnowboarden.com\/"},{"@type":"ListItem","position":2,"name":"Gootloader infection cleaned up"}]},{"@type":"WebSite","@id":"https:\/\/lerensnowboarden.com\/#website","url":"https:\/\/lerensnowboarden.com\/","name":"Leren snowboarden bij Tasha's Snowcamp","description":"Snowboardles in Den Haag","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/lerensnowboarden.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"nl-NL"},{"@type":"Person","@id":"","url":"https:\/\/lerensnowboarden.com\/author"}]}},"_links":{"self":[{"href":"https:\/\/lerensnowboarden.com\/wp-json\/wp\/v2\/posts\/4603"}],"collection":[{"href":"https:\/\/lerensnowboarden.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lerensnowboarden.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lerensnowboarden.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lerensnowboarden.com\/wp-json\/wp\/v2\/comments?post=4603"}],"version-history":[{"count":0,"href":"https:\/\/lerensnowboarden.com\/wp-json\/wp\/v2\/posts\/4603\/revisions"}],"wp:attachment":[{"href":"https:\/\/lerensnowboarden.com\/wp-json\/wp\/v2\/media?parent=4603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lerensnowboarden.com\/wp-json\/wp\/v2\/categories?post=4603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lerensnowboarden.com\/wp-json\/wp\/v2\/tags?post=4603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}