Sodinokibi ransomware affiliates have added malvertising campaigns to the growing list of attack vectors used to infect victims, according to reports.

An exploit kit researcher who goes by the name Nao_sec first provided details about how the ransomware, also known as REvil, is being distributed through malvertising on Twitter. In an interview with Bleeping Computer, Nao_sec said users exposed to the malicious ads through the PopCash network are led directly to the RIG exploit kit, which can then be used to take over a Windows-based machine. The use of RIG means anyone with outdated software could be hit by Sodinokibi ransomware.

How Sodinokibi Gets Around

Malvertising is not a new tactic for cybercriminals, of course, and it’s just one of many ways in which those behind the Sodinokibi ransomware have attempted to increase its distribution capabilities. Other attack vectors so far have included server exploits, spam email campaigns and planting ransomware on sites where it poses as legitimate or safe applications.

More recently, a Reddit group devoted to the managed service provider (MSP) community reported that three MSPs had been hacked using remote management tools such as Webroot SecureAnywhere to deploy Sodinokibi onto customers’ machines.

When the ransomware was initially discovered back in April, security researchers at Cisco Talos said attackers had managed to use a zero-day exploit to infect Oracle WebLogic servers. This not only included Sodinokibi, but also the GandCrab ransomware, which has since been shut down.

The combination of malvertising and exploit kits, however, means Sodinokibi ransomware could reach a much wider pool of potential victims, particularly if they haven’t installed the most recent security updates to their browsers and other Windows-based applications.

Stopping Sodinokibi Before It Spreads

In many respects, malvertising is just another form of phishing in that it uses social engineering techniques — a legitimate-looking online ad, for instance — to dupe people into clicking on and unintentionally exposing their organizations to security threats.

IBM security experts suggest running regular phishing tests internally to ensure that employees are aware of ransomware such as Sodinokibi. Security teams should also use anti-malware tools and have a solid data backup and recovery process to minimize the risk they face.

More from

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…