Rogue Ransomware: Exploiting IT Pros through Deceptive Ads

Report: Hackers Targeting IT Professionals with Malvertisements

Introduction

The cybersecurity research team from Sophos has identified a new campaign called “Nitrogen” that targets IT professionals through fake advertisements, also known as “malvertisements.” These misleading ads are appearing on popular search engines like Google and Bing and lead unsuspecting users to compromised websites and phishing pages. The attackers behind the Nitrogen campaign are using this method to distribute initial access malware and potentially perform future ransomware attacks. Although no successful attacks have been reported yet, hundreds of brands have been co-opted for malvertising across multiple campaigns. This report examines the impact of Nitrogen, the tactics used by the hackers, and provides recommendations for IT professionals to protect themselves and their organizations.

The Nitrogen Campaign

The Nitrogen campaign targets IT professionals by enticing them with popular IT tools. Pay-per-click ads on search engines direct users to compromised WordPress sites and phishing pages that mimic download pages for software such as AnyDesk, Cisco AnyConnect, TreeSize Free, and WinSCP. Visitors who unknowingly download the software they intended also unknowingly download a trojanized Python package containing initial access malware. This malware is then used by the attackers to drop further malicious payloads on the infected systems.

Sophos researchers have recognized the efficiency of this campaign, as IT professionals are responsible for managing sensitive systems within organizations. By targeting them directly, the attackers can quickly gain access to the most critical areas of a corporate network.

The Process and Risk

When users click on a Nitrogen malvertisement, they are led to a phishing page that closely resembles the actual download page for the software they sought. For example, the URL may be “winsccp[.]com,” with an extra “c” subtly added. In some cases, the researchers discovered compromised WordPress sites that had specific download links pointing to malicious phishing pages.

Once users click on the “download” button on these pages, a trojanized ISO installer is downloaded. This installer contains the legitimate software the user intended to download, but it also includes initial access malware. Upon execution, the malware establishes a connection to the attackers’ command and control infrastructure, drops a shell, and installs a Cobalt Strike Beacon. These actions allow the attackers to maintain persistence on the compromised system and execute remote commands.

Potential Motives and Prevention

The researchers refrain from specifying the exact intentions of the attackers, but they draw attention to a report published by Trend Micro, which aligns with the Nitrogen campaign. In that particular case, the attackers used their access gained through malvertising to distribute BlackCat ransomware onto the victim’s network.

Given the potential risks associated with IT professionals being targeted, extra vigilance is necessary. To avoid falling victim to such attacks, Budd advises against searching for software tools online. Instead, users should directly navigate to the official websites of the software makers and download the tools from there. It is crucial to verify the website’s authenticity by checking the HTTPS certificate to ensure a secure connection.

Conclusion

The Nitrogen campaign highlights the growing sophistication of cybercriminals targeting IT professionals through malvertisements. This tactic allows attackers to exploit the proximity of IT professionals to sensitive systems within organizations. While the hit rate may be lower due to the technical expertise of the target audience, the potential impact of successful attacks makes the effort worthwhile for the attackers.

To mitigate the risk of falling victim to such attacks, IT professionals are advised to exercise caution when searching for software online and always download tools directly from the official websites. By following these best practices, organizations can enhance their cybersecurity posture and minimize the potential for future ransomware attacks.

Keywords: Cybersecurity, WordPress, ransomware, IT security, cyberattack, malware, rogue software, deceptive ads