Zloader malware, a tool often used to deliver ransomware, is now being spread through malicious Google ads, according to Microsoft. 

The malware is a key part of the cybercrime industry and recently popped up on the radar of Microsoft and the US Cybersecurity and Infrastructure Security Agency (CISA). 

Recommends

The best cyber insurance

The cyber insurance industry is likely to go mainstream and is a simple cost of doing business. Here are a few options to consider.

Read now

CISA yesterday warned that ZLoader was being used to distribute the Conti ransomware service, which pays ransomware distributors a wage rather than a commission for new infections. 

SEE:Ransomware: This new free tool lets you test if your cybersecurity is strong enough to stop an attack

ZLoader is a banking trojan which uses web injection to steal cookies, passwords and any sensitive information. But it is also used to deliver ransomware and provides attackers with backdoor capabilities and the ability to install other forms of malware, according to security company SentinelOne.

According to Microsoft, ZLoader operators are buying Google keyword ads to distribute various malware strains, including the Ryuk ransomware. 

The techniques aren't new but using Google to distribute links to malicious domains is notable because billions of people use Google. 

"While analyzing ZLoader campaigns in early September, we observed a notable shift in delivery method: from the traditional email campaigns to the abuse of online ad platforms. Attackers purchased ads pointing to websites that host malware posing as legitimate installers," Microsoft said. 

"The campaign abused Google Ads. While Microsoft 365 Defender protects customers by blocking malicious sites, behavior, payloads, we responsibly reported findings to Google. Activity related to this threat reduced in the last few days, but we continue to monitor as it evolves," it added.

The attackers also registered a fraudulent company in order to cryptographically sign the malicious files, which claims to install a legitimate Java-based app but instead deliver ZLoader, giving the attackers access to affected devices. Signing the apps helps avoid detection from anti-malware systems. 

SEE:Four months on from a sophisticated cyberattack, Alaska's health department is still recovering

Microsoft highlights the maturity of the business ecosystem ZLoader operates within. 

"The operators of this campaign can then sell this access to other attackers, who can use it for their own objectives, such as deploying Cobalt Strike or even ransomware," it notes. 

According to security firm Sentinal, this malware campaign primarily targets customers of Australian and German banks. The malware has the capability to disable all Windows 10 Defender anti-malware modules.

While analyzing ZLoader campaigns in early September, we observed a notable shift in delivery method: from the traditional email campaigns to the abuse of online ad platforms. Attackers purchased ads pointing to websites that host malware posing as legitimate installers. pic.twitter.com/8HkR4kmyO6

- Microsoft Security Intelligence (@MsftSecIntel) September 23, 2021

Microsoft says the attackers use Google search keywords to target online ads, which redirect victims to a compromised domain and then bump them across to a domain owned by the attacker for the download. The malware users PowerShell to disable security settings and products like Windows Defender. On some machines, the Cobalt Strike penetration testing kit is downloaded. 

"The operators of this campaign can then sell this access to other attackers, who can use it for their own objectives, such as deploying Cobalt Strike or even ransomware," Microsoft warned. 

Security

8 habits of highly secure remote workersHow to find and remove spyware from your phoneThe best VPN services: How do the top 5 compare?How to find out if you are involved in a data breach -- and what to do next

• 8 habits of highly secure remote workers
• How to find and remove spyware from your phone
• The best VPN services: How do the top 5 compare?
• How to find out if you are involved in a data breach -- and what to do next