Cybercriminals are using malicious Google Ads to deliver the ZLoader banking Trojan, ZDNet reports. Researchers at Microsoft stated on Twitter that attackers are purchasing Google Ads that point to compromised websites, then redirect the user to a malicious website that delivers the malware. The criminals use the ads to target people who search Google for certain keywords.
“While analyzing ZLoader campaigns in early September, we observed a notable shift in delivery method: from the traditional email campaigns to the abuse of online ad platforms,” Microsoft said. “Attackers purchased ads pointing to websites that host malware posing as legitimate installers.”
The attackers also registered a phony company to cryptographically sign the malware files, making them more likely to appear benign to antivirus products.
“In addition to creating malicious installers, this shift in delivery method required to register a fraudulent company so they can sign the malicious files,” Microsoft said. “These files purport to install legitimate apps but instead deliver ZLoader, which provides access to an affected device.”
ZLoader is a remote access Trojan that serves as an initial foothold for additional malware, including ransomware.
“The operators of this campaign can then sell this access to other attackers, who can use it for their own objectives, such as deploying Cobalt Strike or even ransomware,” Microsoft said.
ZDNet notes that the US Cybersecurity and Infrastructure Security Agency (CISA) warned last week that ZLoader is being used to distribute Conti ransomware.
“[CISA] and the Federal Bureau of Investigation (FBI) have observed the increased use of Conti ransomware in more than 400 attacks on U.S. and international organizations,” CISA stated. “In typical Conti ransomware attacks, malicious cyber actors steal files, encrypt servers and workstations, and demand a ransom payment.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for these types of attacks.
ZDNet has the story.
Here's how it works:
