Windows admins targeted with clever malvertising scam

A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.
(Image credit: Getty Images)

Hackers are targeting Windows system administrators with malvertising, hoping to get them infected with ransomware

In a recent campaign, observed by cybersecurity researchers Rapid7, hackers are impersonating two popular Windows utilities - WinSCP, and Putty.

The former is an SFTP/FTP client, while the latter is an SSH client. 

BlackCat deployed

In essence, the campaign is not particularly creative, and relies on system admins being in a hurry, being reckless, or simply trusting their search engines a bit too much. First, the attackers would create fake websites for the above-mentioned tools. The researchers found puutty[.]org, puutty[.]org, wnscp[.]net, and vvinscp[.]net, among others.

They would then find a way to advertise these websites on popular search engines so that when an admin “googles” the tool (instead of typing in the address in the bar, or clicking on a bookmark) the top search result will be a fake website that looks almost identical to the legitimate one.

If they don’t spot the ruse, they will download and install malicious malware loaders which, in turn, deploy ransomware. 

In this campaign, the researchers said, it is possible that the hackers are delivering BlackCat ransomware (also known as ALPHV). This tool was shut down after the successful breach of Change Healthcare, when the company was apparently extorted out of $22 million. After that attack, the group took the money and shut the whole operation down. 

"In a recent incident, Rapid7 observed the threat actor attempt to exfiltrate data using the backup utility Restic, and then deploy ransomware, an attempt which was ultimately blocked during execution," explains Rapid7's Tyler McGraw. "The related techniques, tactics, and procedures (TTP) observed by Rapid7 are reminiscent of past BlackCat/ALPHV campaigns as reported by Trend Micro last year."

Security researchers have, for a while now, warned that users shouldn’t trust search engines too much, as they are often tricked into displaying malicious websites in top spots. 

Via BleepingComputer

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.