IcedID Botnet Distributors Abuse Google PPC to Distribute Malware
Malware
We analyze the latest changes in IcedID botnet from a campaign that abuses Google pay per click (PPC) ads to distribute IcedID via malvertising attacks.
Read time: ( words)
After closely tracking the activities of the IcedID botnet, we have discovered some significant changes in its distribution methods. Since December 2022, we observed the abuse of Google pay per click (PPC) ads to distribute IcedID via malvertising attacks. This IcedID variant is detected by Trend Micro as TrojanSpy.Win64.ICEDID.SMYXCLGZ.
Advertising platforms like Google Ads enable businesses to display advertisements to target audiences for the purpose of boosting traffic and increasing sales. Malware distributors abuse the same functionality in a technique known as malvertising, wherein chosen keywords are hijacked to display malicious ads that lure unsuspecting search engine users to downloading malware.
In our investigation, malicious actors used malvertising to distribute the IcedID malware via cloned webpages of legitimate organizations and well-known applications. Recently, the Federal Bureau of Investigation (FBI) published a warning pertaining to how cybercriminals abuse search engine advertisement services to imitate legitimate brands and direct users to malicious sites for financial gain.
Our blog entry provides the technical details of IcedID botnet’s new distribution method and the new loader it uses.
Technical analysis
Organic search results are those generated by the Google PageRank algorithm, whereas Google Ads appear in more prominent locations above, beside, below, or with the organic search results. When these ads are hijacked by malicious actors via malvertising, they can lead users to malicious websites.
Targeted brands and applications
In our investigation, we discovered that IcedID distributors hijacked the keywords used by these brands and applications to…
