Full Report
Threat actors have been using malicious versions of Advanced IP Scanner to compromise their targets via malvertising campaigns. Let’s analyze one.
Analysis Summary
# Tool/Technique: Malicious Advanced IP Scanner (Malvertising Campaign)
## Overview
Threat actors are utilizing **Malvertising** (malicious advertising) via Google Ads to distribute Trojanized versions of the legitimate "Advanced IP Scanner" utility. The primary purpose is to deceive IT professionals and system administrators into downloading malware that provides attackers with initial access, persistence, and credential theft capabilities within corporate environments.
## Technical Details
- **Type:** Malware Family / Trojanized Utility / Malvertising
- **Platform:** Windows
- **Capabilities:** C2 communication, persistence, credential theft, and evasion of automated analysis.
- **First Seen:** Active campaigns reported throughout 2023 and 2024 (Analysis published April 1, 2024).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]** (Applied via malicious ads)
- **[TA0002 - Execution]**
- **[T1204.002 - User Execution: Malicious File]**
- **[TA0005 - Defense Evasion]**
- **[T1036.005 - Masquerading: Device Proxy]** (Impersonating legitimate software)
- **[T1140 - Deobfuscate/Decode Files or Information]**
- **[T1564 - Hide Artifacts]** (Redirecting non-targeted traffic to legitimate sites)
- **[TA0011 - Command and Control]**
- **[T1071.001 - Application Layer Protocol: Web Protocols]**
## Functionality
### Core Capabilities
- **Impersonation:** The tool appears identical to the legitimate Advanced IP Scanner to avoid user suspicion during the installation process.
- **Payload Delivery:** Drops malicious payloads (often DLLs or scripts) onto the host system upon execution of the installer.
- **Traffic Redirection:** The hosting site uses "cloaking" to redirect standard visitors to the legitimate `advanced-ip-scanner.com` while serving the malware only to those reaching the site via specific Google Ad referrers.
### Advanced Features
- **Conditional Hosting:** The malicious server checks the `Referer` header. If the header does not match a Google search origin (e.g., `https://www.google.com/`), the server hides the malicious file.
- **Persistence:** Often installs background services or registry modifications to maintain access after the initial setup.
## Indicators of Compromise
- **File Names:** `Advanced_IP_Scanner_2.5.4594.1.exe` (Note: Versions may vary to match current legitimate releases).
- **Network Indicators:**
- `hxxps://advanced[.]ip-scanner[.]co`
- `hxxps://www.advanced-ip-scanner[.]co`
- **Behavioral Indicators:**
- High-volume HTTP GET requests with spoofed `Referer` headers.
- Installation of signed/unsigned binaries to non-standard directories (e.g., `AppData\Local`).
## Associated Threat Actors
- While specific groups vary, these techniques are commonly associated with **Initial Access Brokers (IABs)** and Ransomware affiliates (such as those deploying **BlackCat/ALPHV** or **Prestige**).
## Detection Methods
- **Signature-based detection:** Monitoring for MD5/SHA256 hashes of known malicious installers that deviate from the official developer's signature (Famatech).
- **Behavioral detection:**
- Detecting redirects from suspicious domains to legitimate software sites.
- Monitoring for `Referer` header manipulation in web logs.
- Flagging installation of administrative tools from non-official domains.
- **Network Inspection:** Scanning for traffic to known typosquatted or look-alike domains.
## Mitigation Strategies
- **Prevention measures:** Implement ad-blocking software at the enterprise level to prevent malvertising from reaching end-users.
- **Hardening recommendations:**
- Enforce the use of an internal "Approved Software List" or private repository.
- Restrict administrative rights to prevent users from installing software.
- Use DNS filtering to block newly registered or known malicious domains (e.g., `.co` or `.top` variants of legitimate sites).
## Related Tools/Techniques
- **Typosquatting:** Creating domains that look like legitimate brands.
- **Cloaking:** Serving different content to different users based on IP, User-Agent, or Referrer.
- **AnyDesk/ScreenConnect Malvertising:** Similar campaigns targeting other remote desktop and admin tools.