Malvertising Used as Entry Vector for BlackCat, Actors Also Leverage SpyBoy Terminator

We found that malicious actors used malvertising to distribute malware via cloned webpages of legitimate organizations. The distribution involved a webpage of the well-known application WinSCP, an open-source Windows application for file transfer. We were able to identify that this activity led to a BlackCat (aka ALPHV) infection, and actors also used SpyBoy, a terminator that tampers with protection provided by agents.

alphv application blackcat distribution entry file file transfer identify infection led malicious malicious actors malvertising malware organizations reports terminator transfer trend micro research : articles trend micro research : endpoints trend micro research : malware trend micro research : research trend micro research : web well-known windows