Ongoing Malvertising Campaign Results in Ransomware Attacks

MITRE Techniques

• [T1583.008] Acquire Infrastructure: Malvertising – The threat actor uses ads to promote malware delivery via popular search engines. [ ‘The threat actor uses ads to promote malware delivery via popular search engines.’ ]
• [T1189] Drive-by Compromise – The user clicks on a malicious ad populated from a typical search engine query for a software utility and is ultimately redirected to a page hosting malware. [ ‘The user clicks on a malicious ad populated from a typical search engine query for a software utility and is ultimately redirected to a page hosting malware.’ ]
• [T1106] Native API – The malware dynamically resolves and executes functions from ntdll.dll at runtime. [ ‘The malware dynamically resolves and executes functions from ntdll.dll at runtime.’ ]
• [T1204.002] User Execution: Malicious File – The user downloads and executes setup.exe (renamed pythonw.exe), which side-loads and executes the malicious DLL python311.dll. [ ‘The user downloads and executes setup.exe (renamed pythonw.exe), which side-loads and executes the malicious DLL python311.dll.’ ]
• [T1059.006] Command and Scripting Interpreter: Python – The malware executes a python script to load and execute a Sliver beacon. [ ‘The malware executes a python script to load and execute a Sliver beacon.’ ]
• [T1543.003] Create or Modify System Process: Windows Service – The threat actor creates a service to execute a C2 beacon. The threat actor loads a vulnerable driver to facilitate disabling antivirus software and other defenses present. [ ‘The threat actor creates a service to execute a C2 beacon. The threat actor loads a vulnerable driver to facilitate disabling antivirus software and other defenses present.’ ]
• [T1053.005] Scheduled Task/Job: Scheduled Task – The threat actor creates a scheduled task to execute a C2 beacon. [ ‘The threat actor creates a scheduled task to execute a C2 beacon.’ ]
• [T1140] Deobfuscate/Decode Files or Information – The malware uses various string manipulation and obfuscation techniques. [ ‘The malware uses various string manipulation and obfuscation techniques.’ ]
• [T1222.001] File and Directory Permissions Modification: Windows File and Directory Permissions Modification – The malware calls chmod to change file permissions prior to execution. [ ‘The malware calls chmod to change file permissions prior to execution.’ ]
• [T1574.001] Hijack Execution Flow: DLL Search Order Hijacking – The malware contained in python311.dll is loaded by a renamed copy of pythonw.exe from the same directory. [ ‘The malware contained in python311.dll is loaded by a renamed copy of pythonw.exe from the same directory.’ ]
• [T1574.002] Hijack Execution Flow: DLL Side-Loading – The malware contained in python311.dll is loaded by a renamed copy of pythonw.exe and proxies requests to a renamed copy of the legitimate DLL. [ ‘The malware contained in python311.dll is loaded by a renamed copy of pythonw.exe and proxies requests to a renamed copy of the legitimate DLL.’ ]
• [T1027.002] Obfuscated Files or Information: Software Packing – The final payload executed by the malware is unpacked through several layers of compression, encryption, and file formats. [ ‘The final payload executed by the malware is unpacked through several layers of compression, encryption, and file formats.’ ]
• [T1027.013] Obfuscated Files or Information: Encrypted/Encoded File – The malware also stores other file dependencies with several layers of obfuscation. [ ‘The malware also stores other file dependencies with several layers of obfuscation.’ ]
• [T1055.001] Process Injection: Dynamic-link Library Injection – The malware loads a Sliver beacon DLL via python script. [ ‘The malware loads a Sliver beacon DLL via python script.’ ]
• [T1570] Lateral Movement: Lateral Tool Transfer – The threat actor uses SMB via Cobalt Strike to pivot post compromise. [ ‘The threat actor uses SMB via Cobalt Strike to pivot post compromise.’ ]
• [T1567.002] Exfiltration Over Web Service: Exfiltration to Cloud Storage – The threat actor attempts to exfiltrate data to a backup using Restic. [ ‘The threat actor attempts to exfiltrate data to a backup using Restic.’ ]
• [T1486] Data Encrypted for Impact – The threat actor attempts the deployment of ransomware after exfiltrating data. [ ‘The threat actor attempts the deployment of ransomware after exfiltrating data.’ ]