Microsoft Warns of Hackers Using Google Ads to Distribute Royal Ransomware

A developing threat activity cluster has been found using Google
Ads in one of its campaigns to distribute various post-compromise
payloads, including the recently discovered Royal ransomware^[1].

Microsoft, which spotted the updated malware delivery method in
late October 2022, is tracking the group under the name
DEV-0569.

“Observed DEV-0569 attacks show a pattern of continuous
innovation, with regular incorporation of new discovery techniques,
defense evasion, and various post-compromise payloads, alongside
increasing ransomware facilitation,” the Microsoft Security Threat
Intelligence team said^[2]
in an analysis.

The threat actor is known to rely on malvertising to point
unsuspecting victims to malware downloader links that pose as
software installers for legitimate apps like Adobe Flash Player,
AnyDesk, LogMeIn, Microsoft Teams, and Zoom.

The malware downloader, a strain referred to as BATLOADER^[3], is a dropper that
functions as a conduit to distribute next-stage payloads. It has
been observed to share overlaps with another malware called
ZLoader^[4].

A recent analysis of BATLOADER by eSentire^[5]
and VMware^[6]
called out the malware’s stealth and persistence, in addition to
its use of search engine optimization (SEO) poisoning to lure users
to download the malware from compromised websites or
attacker-created domains.

Alternatively, phishing links are shared through spam emails,
fake forum pages, blog comments, and even contact forms^[7]
present on targeted organizations’ websites.

“DEV-0569 has used varied infection chains using PowerShell and
batch scripts that ultimately led to the download of malware
payloads like information stealers or a legitimate remote
management tool used for persistence on the network,” the tech
giant noted.

“The management tool can also be an access point for the staging
and spread of ransomware.”

Also utilized is a tool known as NSudo to launch programs with
elevated privileges and impair defenses by adding registry values
that are designed to disable antivirus solutions.

The use of Google Ads to deliver BATLOADER selectively marks a
diversification of the DEV-0569’s distribution vectors, enabling it
to reach more targets and deliver malware payloads, the company
pointed out.

It further positions the group to serve as an initial access broker^[8]
for other ransomware operations, joining the likes of malware such
as Emotet^[9], IcedID^[10], Qakbot^[11].

“Since DEV-0569’s phishing scheme abuses legitimate services,
organizations can also leverage mail flow rules to capture
suspicious keywords or review broad exceptions, such as those
related to IP ranges and domain-level allow lists,” Microsoft
said.