Watch out - these fake ads for Slack and Cisco are just malware

The Google Ads network has once again been hijacked to try and get victims to download initial access malware called Nitrogen, which can then be used to  deploy ALPHV (AKA BlackCat), one of the most popular and destructive ransomware variants around today.

New research from eSentire said it observed a new campaign targeting corporations and public entities in the Americas and Europe. 

“In the past three weeks, we have seen these affiliates attempt to breach a law firm, a manufacturer, and a warehouse provider within our customer network, alongside attacking other companies,” the researchers said.

Reader Offer: $50 Amazon gift card with demo
Perimeter 81's Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.

Preferred partner (What does this mean?) 

Ongoing campaign

While the campaign might be fresh, its modus operandi is nothing new. Hackers would first compromise Google accounts that professionals use to set up ad campaigns and promote their businesses. This could be done via malware, social engineering, or simply by purchasing login credentials on the dark web. Then, they would set up a fake landing page, impersonating popular brands and offering software that business users often search for. In this case, that includes Advanced IP Scanner, Slack, WinSCP, and Cisco AnyConnect.

Then, they would run ads on the Google network promoting these landing pages, and while unsuspecting victims might think they’re downloading legitimate software, they’re in fact infecting their endpoints with Nitrogen.

Nitrogen, in turn, helps the attackers deploy BlackCat, which is then used to steal sensitive data and encrypt all of the files stored on the target network. The final step is to demand a ransom in exchange for the decryption key and for not leaking the data public.

Keegan Keplinger, Senior Threat Intelligence Researcher with TRU, said this campaign is a continuation of the campaign observed in June 2023, in which the attackers basically did the same thing. It’s also worth mentioning that BlackCat is a Ransomware-as-a-Service (RaaS) and that any of its numerous affiliates could have set this campaign up.

More from TechRadar Pro

• Google and Bing search ads hijacked to spread malware
• Here's a list of the best firewalls today
• These are the best endpoint security tools right now