Windows admins targeted with clever malvertising scam

Date:
Mon, 20 May 2024 10:30:00 +0000

Description:
Don't google your favorite system tools. Or, at the very least, be careful when clicking on the results.

FULL STORY ======================================================================

Hackers are targeting Windows system administrators with malvertising, hoping to get them infected with ransomware .

In a recent campaign, observed by cybersecurity researchers Rapid7, hackers are impersonating two popular Windows utilities - WinSCP, and Putty.

The former is an SFTP/FTP client, while the latter is an SSH client. BlackCat deployed

In essence, the campaign is not particularly creative, and relies on system admins being in a hurry, being reckless, or simply trusting their search engines a bit too much. First, the attackers would create fake websites for the above-mentioned tools. The researchers found puutty[.]org, puutty[.]org, wnscp[.]net, and vvinscp[.]net, among others.

They would then find a way to advertise these websites on popular search engines so that when an admin googles the tool (instead of typing in the address in the bar, or clicking on a bookmark) the top search result will be
a fake website that looks almost identical to the legitimate one.

If they dont spot the ruse, they will download and install malicious malware loaders which, in turn, deploy ransomware.

In this campaign, the researchers said, it is possible that the hackers are delivering BlackCat ransomware (also known as ALPHV). This tool was shut down after the successful breach of Change Healthcare , when the company was apparently extorted out of $22 million. After that attack, the group took the money and shut the whole operation down.

"In a recent incident, Rapid7 observed the threat actor attempt to exfiltrate data using the backup utility Restic, and then deploy ransomware, an attempt which was ultimately blocked during execution," explains Rapid7's Tyler McGraw. "The related techniques, tactics, and procedures (TTP) observed by Rapid7 are reminiscent of past BlackCat/ALPHV campaigns as reported by Trend Micro last year."

Security researchers have, for a while now, warned that users shouldnt trust search engines too much, as they are often tricked into displaying malicious websites in top spots. More from TechRadar Pro Change Healthcare attack that disrupted prescriptions blamed on BlackCat ransomware Here's a list of the best firewalls today These are the best endpoint protection tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/windows-admins-targeted-with-clever-mal vertising-scam


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)