Malvertising Scheme targets baleful ads on Yandex.Direct

Yandex.Direct Compromised with Malvertising Attack  

Cyber Crooks have recently been reported to exploit Yandex.Direct, a Russian Online Marketing Service via a malign advertising campaign. This Malvertising scheme is supplying malevolent ads & targeting a large number of Russian accountants with the sole motive of transmitting Ransomware & Banking Trojans to them.

This colossal Malvertising Attack is propagating a plethora of malware that has specifically been designed to encipher user’s data & whip Cryptocurrency.

Cyber Security analysts from ESET, an IT Security Company headquartered in Slovakia, have found around 6 malware agendas associated with this ongoing Malvertising scheme. From the past few months the hacking group is targeting Russian organizations & using two renowned backdoors namely- Buhtrap & RTM along with Cryptocurrency Stealers & Ransomware.

The Malvertising scheme primarily targeted commercial accounting branches by fastening malevolent adverts through Yandex.Direct. The attackers compromised the systems of users searching for contract examples & contract forms by redirecting them to websites offering spiteful downloads masqueraded as doc templates.

Insight into the Distribution Mechanism Implemented by Attackers

Researchers of Slovakian IT Firm- ESET disclosed that the potential targets searching for keywords like download invoice template, example of legal contracts were enticed to the Malvertising scheme ridden pages. It is evident that the corporate entities were at the target of this malvertising campaign that rendered the accountant’s compromised.

The attackers smartly knot different payloads together & swarmed all the malicious files on 2 diverse GitHub repositories. However, the files were left on the repository for a restricted time-frame only, that too when the Ad Drive was active. It was found that most of the times GitHub Payload was left with an empty ZIP File or a clean .EXE.

This Malvertising Campaign is reported to have launched in October 2018 & has continued invading the accountant’s systems since then. Six different malware families are being horded on the GitHub Repository.

Researchers found that cyber crooks were able to ensnare the victims to download the malevolent files through a website. The website’s blueprint & spiteful file names given by the fraudsters were quite beguiling- contained information about form samples, templates, contract samples etc.  

The fake software mentioned on the website reads as – “Collection of templates 2018: forms, templates, contracts & samples.”

Read More