Cybercriminals are using malicious Google Ads to deliver the ZLoader banking Trojan, ZDNet reports. Researchers at Microsoft stated on Twitter that attackers are purchasing Google Ads that point to compromised websites, then redirect the user to a malicious website that delivers the malware. The criminals use the ads to target people who search Google for certain keywords.

“While analyzing ZLoader campaigns in early September, we observed a notable shift in delivery method: from the traditional email campaigns to the abuse of online ad platforms,” Microsoft said. “Attackers purchased ads pointing to websites that host malware posing as legitimate installers.”

The attackers also registered a phony company to cryptographically sign the malware files, making them more likely to appear benign to antivirus products.

“In addition to creating malicious installers, this shift in delivery method required to register a fraudulent company so they can sign the malicious files,” Microsoft said. “These files purport to install legitimate apps but instead deliver ZLoader, which provides access to an affected device.”

ZLoader is a remote access Trojan that serves as an initial foothold for additional malware, including ransomware.

“The operators of this campaign can then sell this access to other attackers, who can use it for their own objectives, such as deploying Cobalt Strike or even ransomware,” Microsoft said.

ZDNet notes that the US Cybersecurity and Infrastructure Security Agency (CISA) warned last week that ZLoader is being used to distribute Conti ransomware.

“[CISA] and the Federal Bureau of Investigation (FBI) have observed the increased use of Conti ransomware in more than 400 attacks on U.S. and international organizations,” CISA stated. “In typical Conti ransomware attacks, malicious cyber actors steal files, encrypt servers and workstations, and demand a ransom payment.”

New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for these types of attacks.

ZDNet has the story.

** Optrics Inc. is an Authorized KnowBe4 partner

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

Here’s how it works:

• Immediately start your test for up to 100 users (no need to talk to anyone)
• Select from 20+ languages and customize the phishing test template based on your environment
• Choose the landing page your users see after they click
• Show users which red flags they missed, or a 404 page
• Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
• See how your organization compares to others in your industry

Find out how affordable new-school security awareness training is for your organization. Get a quote now.

The original article can be found here:

https://blog.knowbe4.com/google-ads-abused-to-deliver-malware