When trusted sites turn. [Research Saturday]

Key takeaways

Drive Surge is a newly identified threat actor controlling a large-scale, sophisticated campaign involving thousands of compromised websites.
The group uses infrastructure like zTDS to redirect visitors in a covert manner, employing techniques such as click-fix and fake browser update tactics.
Defenders should focus on infrastructure fingerprinting, monitoring server configurations, and collaborating across the industry to identify and disrupt such campaigns.
End users need to exercise caution online—avoid clicking on suspicious pop-ups or downloads, and question unexpected prompts.
The scale and operational sophistication of Drive Surge reflect a well-organized cybercriminal enterprise, akin to a company, emphasizing the need for constant vigilance and industry cooperation.

Summary

Introduction and Event Promotions

The episode opens with mentions of cybersecurity events and promotions, notably Black Hat USA scheduled for August 1-6, with a discount code 'CyberWire' for $200 off registration. The introduction sets the tone for a cybersecurity-focused discussion, emphasizing ongoing learning and community engagement.

Research Focus: Drive Surge Threat Actor

The core of the episode centers on research by Lauren Fiboson from Silent Push, who discusses 'Drive Surge,' a relatively new threat actor targeting thousands of websites. This group uses sophisticated click-fix and fake update drive-by attacks, leveraging infrastructure like the zTDS traffic distribution system to silently redirect visitors to malicious payloads. Their operations involve large-scale compromises, targeting both Windows and macOS users, and employing obfuscation and fingerprinting to evade detection. The research highlights the scale of this operation and provides insights into its infrastructure, tactics, and possible origins, suggesting it might be a new or rebranded initial access brokerage—or IAB.

Detection and Defense Strategies

The discussion also touches on technical indicators and fingerprints associated with Drive Surge’s infrastructure, including server configurations and URL patterns. For defenders, key advice includes increasing awareness, avoiding suspicious pop-ups, verifying website integrity, and working collaboratively to block malicious activity. The importance of community efforts and vigilance is emphasized, as the scale and complexity of such operations make individual efforts insufficient.

Industry Insights and Conclusions

The episode concludes with reflections on the industrialized nature of cybercriminal infrastructure—highlighting how groups like Drive Surge operate like companies with extensive resources and professional setups. The overarching message stresses the importance of awareness, community collaboration, and ongoing research to combat these evolving threats.

Show notes

Lauren Fievisohn, Ph.D, Senior Threat Researcher from Silent Push, is sharing their work on "Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites." Silent Push researchers have identified a newly named threat actor, DriveSurge, which has compromised thousands of legitimate websites and uses ClickFix and fake browser update lures to distribute malware at scale through a pay-per-install operation.

The group leverages a traffic distribution system called zTDS to silently redirect visitors from trusted websites to malicious payloads, while employing sophisticated infrastructure, obfuscation, and fingerprinting techniques to evade detection. The report also details how DriveSurge targets both Windows and macOS users and provides defenders with eight infrastructure fingerprints to help identify and disrupt the campaign.

The research and executive brief can be found here:

Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites

Learn more about your ad choices. Visit megaphone.fm/adchoices