Hackers are planting fake advertisements - "malvertisements" - for popular IT tools on search engines, hoping to ensnare IT professionals and perform future ransomware attacks.
The scheme surrounds pay-per-click ads on sites like Google and Bing, which link to compromised Wordpress sites and phishing pages mimicking download pages for software such as AnyDesk, Cisco AnyConnect, TreeSize Free, and WinSCP. Unsuspecting visitors end up downloading the actual software they intended, alongside a trojanized Python package containing initial access malware, which the attackers then use to drop further payloads. Researchers from Sophos are
calling the campaign "Nitrogen." It has already touched several technology companies and nonprofits in North America. Though none of the known cases have yet been successful, the researchers noted that "hundreds of brands co-opted for malvertising of this sort across multiple campaigns in recent months."
"The key thing here is that they're targeting IT people," says Christopher Budd, director of Sophos X-Ops. Skipping right to the people closest to an organization's most sensitive systems, he says, "is actually a fairly efficient and effective way of targeting."
