Sodinokibi ransomware affiliates have added malvertising campaigns to the growing list of attack vectors used to infect victims, according to reports.

An exploit kit researcher who goes by the name Nao_sec first provided details about how the ransomware, also known as REvil, is being distributed through malvertising on Twitter. In an interview with Bleeping Computer, Nao_sec said users exposed to the malicious ads through the PopCash network are led directly to the RIG exploit kit, which can then be used to take over a Windows-based machine. The use of RIG means anyone with outdated software could be hit by Sodinokibi ransomware.

How Sodinokibi Gets Around

Malvertising is not a new tactic for cybercriminals, of course, and it’s just one of many ways in which those behind the Sodinokibi ransomware have attempted to increase its distribution capabilities. Other attack vectors so far have included server exploits, spam email campaigns and planting ransomware on sites where it poses as legitimate or safe applications.

More recently, a Reddit group devoted to the managed service provider (MSP) community reported that three MSPs had been hacked using remote management tools such as Webroot SecureAnywhere to deploy Sodinokibi onto customers’ machines.

When the ransomware was initially discovered back in April, security researchers at Cisco Talos said attackers had managed to use a zero-day exploit to infect Oracle WebLogic servers. This not only included Sodinokibi, but also the GandCrab ransomware, which has since been shut down.

The combination of malvertising and exploit kits, however, means Sodinokibi ransomware could reach a much wider pool of potential victims, particularly if they haven’t installed the most recent security updates to their browsers and other Windows-based applications.

Stopping Sodinokibi Before It Spreads

In many respects, malvertising is just another form of phishing in that it uses social engineering techniques — a legitimate-looking online ad, for instance — to dupe people into clicking on and unintentionally exposing their organizations to security threats.

IBM security experts suggest running regular phishing tests internally to ensure that employees are aware of ransomware such as Sodinokibi. Security teams should also use anti-malware tools and have a solid data backup and recovery process to minimize the risk they face.

More from

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

How I Got Started: White Hat Hacker

3 min read - White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping organizations bolster their digital defenses. But what drives someone to pursue a career as a white hat hacker, and how do you get started in leveraging so-called “evil” skills for the greater good?? In this exclusive Q&A, we spoke with…

3 min read

Heads Up CEO! Cyber Risk Influences Company Credit Ratings

4 min read - More than ever, cybersecurity strategy is a core part of business strategy. For example, a company’s cyber risk can directly impact its credit rating. Credit rating agencies continuously strive to gain a better understanding of the risks that companies face. Today, those agencies increasingly incorporate cybersecurity into their credit assessments. This allows agencies to evaluate a company’s capacity to repay borrowed funds by factoring in the risk of cyberattacks. Getting Hacked Impacts Credit Scoring As per the Wall Street Journal…

4 min read

Zombie APIs are a Top Security Concern as API Attacks Surge 400%

4 min read - Organizations of all sizes rely on application programming interfaces (APIs). The API explosion has been driven by several factors, including cloud computing, demand for mobile/web applications, microservices architecture and the API economy as a business model. APIs enable developers to access data remotely, integrate with other services, build modular applications and monetize their data/services. For enterprises that participated in a recent research study, the average number of APIs per organization was 15,564. Large enterprises (over 10,000 employees) had an average…

4 min read