Cybercriminals Are Using Malicious Ads to Attack Windows Administrators
Ransomware (ransomware) cyber groups are using search engine ads to introduce fake Putty and WinSCP download sites.
Ransomware Attack Using Malvertising Targeting Windows System Administrators
A ransomware operation targets Windows system administrators and uses search engine ads to introduce fake download sites through two popular utilities: Putty and WinSCP.
Research by Rapid7 shows that a malicious advertising campaign introduces download sites for utilities by performing searches for "winscp indir" and "macun indir". The sites mimic the legitimate WinSCP site and a site that appears to link to PuTTY but is not the actual site.
The fake websites contain download links that direct users to download a ZIP file from threat actors' servers. The ZIP archive contains an executable 'Setup.exe' and a malicious 'python311.dll' file.
Source: Cybercriminals Use Malvertising to Attack Windows Admins (itsecurity.pt)