Google Ads Abused to Deliver Malware
Cybercriminals are using malicious Google Ads to deliver the ZLoader banking Trojan, ZDNet reports. Researchers at Microsoft stated on Twitter that attackers are purchasing Google Ads that point to compromised websites, then redirect the user to a malicious website that delivers the malware. The criminals use the ads to target people who search Google for certain keywords.
“While analyzing ZLoader campaigns in early September, we observed a notable shift in delivery method: from the traditional email campaigns to the abuse of online ad platforms,” Microsoft said. “Attackers purchased ads pointing to websites that host malware posing as legitimate installers.”
The attackers also registered a phony company to cryptographically sign the malware files, making them more likely to appear benign to antivirus products.
“In addition to creating malicious installers, this shift in delivery method required to register a fraudulent company so they can sign the malicious files,” Microsoft said. “These files purport to install legitimate apps but instead deliver ZLoader, which provides access to an affected device.”
ZLoader is a remote access Trojan that serves as an initial foothold for additional malware, including ransomware.
“The operators of this campaign can then sell this access to other attackers, who can use it for their own objectives, such as deploying Cobalt Strike or even ransomware,” Microsoft said.
ZDNet notes that the US Cybersecurity and Infrastructure Security Agency (CISA) warned last week that ZLoader is being used to distribute Conti ransomware.
“[CISA] and the Federal Bureau of Investigation (FBI) have observed the increased use of Conti ransomware in more than 400 attacks on U.S. and international organizations,” CISA stated. “In typical Conti ransomware attacks, malicious cyber actors steal files, encrypt servers and workstations, and demand a ransom payment.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for these types of attacks.
ZDNet has the story.
Free Ransomware Simulator Tool
Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?
KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.
Here’s how it works:
- 100% harmless simulation of real ransomware and cryptomining infections
- Does not use any of your own files
- Tests 21 types of infection scenarios
- Just download the install and run it
- Results in a few minutes!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW