FIN7 Leverages Malicious Google Ads to Deliver RAT

The global landscape of cyber threats persist in mutating rapidly and becoming even more audacious, with no boundaries or brands impervious to the onslaught. A recent case in point that has been resoundingly strident is the FIN7 hacker group's latest modus operandi: deploying Regrettably Advanced Threats (RATs) by leveraging malicious Google advertisements that artfully spoof authentic brands.

Cybersecurity titan eSentire's publication early this week revealed a startling fact: Fraudulent websites have been configured to masquerade as universally recognized brands including BlackRock, The Wall Street Journal, Google Meet, AnyDesk, Asana, Concur, WinSCP, and Workable among others.

Esteemed for its unrelenting persistence since its genesis in 2013, FIN7, also known by its other aliases, Carbon Spider and Sangria Tempest, was initially acclaimed for its expert cyber-attacks aimed at point-of-sale devices, surreptitiously pilfering valuable payment data. In recent years though, the group has exhibited an inevitable mutation, now choosing to hack into leading firms via intensive ransomware campaigns.

Notably, the malevolent group evolved, adeptly fine-tuning its strategies and malware toolbox, replete with customized malware families termed BIRDWATCH, Carbanak, DICELOADER (Lizar and Tirion), POWERPLANT, POWERTRASH, and TERMITE. As one delves deeper into the rabbit hole, FIN7 is primarily known to deploy its malicious software via spear-phishing campaigns initiating the attack, although recently, the group has incorporated malvertising methods for the advent of their incursions.

In the closing phase of 2023, Microsoft inadvertently fell prey to observe these cyber perpetrators employ Google ads to bait users into downloading treacherous MSIX application packages. This ultimately led to the execution of POWERTRASH, an insidious, PowerShell-based, in-memory dropper that was employed to unload the NetSupport RAT and Gracewire.

Microsoft observed, "Sangria Tempest is a profit-driven cybercriminal group that currently prioritizes incursions leading frequently to data theft, followed by targeted blackmail or ransomware deployment such as Clop ransomware."

In quick response to the rising abuse of MSIX as a malware distribution route by numerous threat actors, particularly because it bypasses security systems like Microsoft Defender SmartScreen, Microsoft has since defaulted to disable the protocol handler.

In April 2024, eSentire observed attacks lure users via Google ads to fraudulent sites which in turn presented a pop-up message, urging users to download a counterfeit browser extension. This extension, serendipitously an MSIX file, contained a PowerShell script that further arranged system information and communicated with a remote server to procure another encrypted PowerShell script.

The final PowerShell payload was then employed to download and execute the NetSupport RAT from an actor-controlled server. eSentire detected an additional malware delivery via the remote access trojan, including DICELOADER through a Python script.

eSentire echoed, "The incidents of FIN7 exploiting respected brand names and deploying deceptive web advertisements to disseminate NetSupport RAT succeeded by DICELOADER illuminate the perpetual threat, especially with the misuse of signed MSIX files by these actors, which has proven effective in their schemes."

Malwarebytes independently echoed these findings, describing the activity as targeting corporate users by mimicking popular brands like Asana, BlackRock, CNN, Google Meet, SAP, and The Wall Street Journal via malicious ads and modals. Yet, it refrained from attributing the malicious campaign to FIN7.

The escalating, relentless threat scenario underscores the essential need for us, as personal users or corporate entities, to deploy a highly discerning eye while we navigate our digital landscape. Stay vigilant and safe, and remember that sometimes, not all that glitters is gold — or rather, not every Google ad is genuine. #CyberSecurityAwareness #TechSafety #InternetSecurity #DataProtection #CyberRiskManagement #InfoSec #SecureHosting #DigitalDefense #TechOffers #CyberSolutions #OnlineSafetyTips #CyberThreatPrevention #TripleyTechAdvantage #FreeTechSubscription #ProtectYourData #TechSecurityTrends #SmartCyberChoices #SecureYourNetwork #CyberSecExperts #InnovativeCyberTech