Windows admins targeted with clever malvertising scam

Hackers are targeting Windows system administrators with malvertising, hoping to get them infected with ransomware. 

In a recent campaign, observed by cybersecurity researchers Rapid7, hackers are impersonating two popular Windows utilities - WinSCP, and Putty.

The former is an SFTP/FTP client, while the latter is an SSH client. 

BlackCat deployed

In essence, the campaign is not particularly creative, and relies on system admins being in a hurry, being reckless, or simply trusting their search engines a bit too much. First, the attackers would create fake websites for the above-mentioned tools. The researchers found puutty[.]org, puutty[.]org, wnscp[.]net, and vvinscp[.]net, among others.

They would then find a way to advertise these websites on popular search engines so that when an admin “googles” the tool (instead of typing in the address in the bar, or clicking on a bookmark) the top search result will be a fake website that looks almost identical to the legitimate one.

If they don’t spot the ruse, they will download and install malicious malware loaders which, in turn, deploy ransomware. 

In this campaign, the researchers said, it is possible that the hackers are delivering BlackCat ransomware (also known as ALPHV). This tool was shut down after the successful breach of Change Healthcare, when the company was apparently extorted out of $22 million. After that attack, the group took the money and shut the whole operation down. 

"In a recent incident, Rapid7 observed the threat actor attempt to exfiltrate data using the backup utility Restic, and then deploy ransomware, an attempt which was ultimately blocked during execution," explains Rapid7's Tyler McGraw. "The related techniques, tactics, and procedures (TTP) observed by Rapid7 are reminiscent of past BlackCat/ALPHV campaigns as reported by Trend Micro last year."

Security researchers have, for a while now, warned that users shouldn’t trust search engines too much, as they are often tricked into displaying malicious websites in top spots. 

More from TechRadar Pro

• Change Healthcare attack that disrupted prescriptions blamed on BlackCat ransomware
• Here's a list of the best firewalls today
• These are the best endpoint protection tools right now