BLOG: Malvertising Campaign Distributes Malicious AnyDesk Installer

On Wednesday, Cybersecurity researchers revealed the disruption of a malvertising network targeting the AnyDesk, which is software that allows users to “connect to a computer remotely, be it from the other end of the office or halfway around the world”, the malvertising network delivered a modified version of the installer through the use of Google ads that appeared in the search engine results pages.

The campaign, which is believed to have commenced April 21st, 2021, entails a malicious file that imitates a setup executable for AnyDesk (AnyDeskSetup.exe), which once installed, downloads a PowerShell implant to accumulate and withdraw system information.

AnyDesk’s remote desktop access solution has been downloaded by more than 300 million users worldwide, according to the company’s website. Although the cybersecurity firm did not attribute the cyber activity to a specific threat actor or nexus, it suspected it to be a “widespread campaign affecting a wide range of customers” given the large user base.

The PowerShell script may appear like a generic backdoor, however, it is the intrusion route where the attack throws a curve, signalling that it’s beyond a garden-variety data gathering operation the AnyDesk installer is distributed through malicious Google ads placed by the threat actor, which are then served to unsuspecting people who are using Google to search for ‘AnyDesk.’

The fraudulent ad result, when clicked, redirects users to a page that is a replica of the genuine AnyDesk website, in addition to providing the individual with a link to the warped installer.

Cybersecurity professionals estimate that 40% of clicks on the malicious Google ad turned into installations of the altered AnyDesk installer, and 20% of those installations included follow-on hands-on-keyboard activity. Google was notified about these findings and is said to have undertaken immediate action to take down the ad. This technique provided threat actors with the capability to spontaneously select targets of interest. Due to the nature of the Google advertising platform, it can provide an estimate of how many people will click on the ad. This allows the threat actors to sufficiently strategise and budget based on this information.