Sodinokibi ransomware affiliates have added malvertising campaigns to the growing list of attack vectors used to infect victims, according to reports.
An exploit kit researcher who goes by the name Nao_sec first provided details about how the ransomware, also known as REvil, is being distributed through malvertising on Twitter. In an interview with Bleeping Computer, Nao_sec said users exposed to the malicious ads through the PopCash network are led directly to the RIG exploit kit, which can then be used to take over a Windows-based machine. The use of RIG means anyone with outdated software could be hit by Sodinokibi ransomware.
How Sodinokibi Gets Around
Malvertising is not a new tactic for cybercriminals, of course, and it’s just one of many ways in which those behind the Sodinokibi ransomware have attempted to increase its distribution capabilities. Other attack vectors so far have included server exploits, spam email campaigns and planting ransomware on sites where it poses as legitimate or safe applications.
More recently, a Reddit group devoted to the managed service provider (MSP) community reported that three MSPs had been hacked using remote management tools such as Webroot SecureAnywhere to deploy Sodinokibi onto customers’ machines.
When the ransomware was initially discovered back in April, security researchers at Cisco Talos said attackers had managed to use a zero-day exploit to infect Oracle WebLogic servers. This not only included Sodinokibi, but also the GandCrab ransomware, which has since been shut down.
The combination of malvertising and exploit kits, however, means Sodinokibi ransomware could reach a much wider pool of potential victims, particularly if they haven’t installed the most recent security updates to their browsers and other Windows-based applications.
Stopping Sodinokibi Before It Spreads
In many respects, malvertising is just another form of phishing in that it uses social engineering techniques — a legitimate-looking online ad, for instance — to dupe people into clicking on and unintentionally exposing their organizations to security threats.
IBM security experts suggest running regular phishing tests internally to ensure that employees are aware of ransomware such as Sodinokibi. Security teams should also use anti-malware tools and have a solid data backup and recovery process to minimize the risk they face.