Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Apate Web: An Evasive Large-Scale Scareware and PUP Delivery Campaign

Summary: Unit 42 researchers identified a campaign they call ApateWeb that uses a network of over 130,000 domains to deliver scareware, potentially unwanted programs and scam pages, with activity spiking since August 2022 and continuing through 2024. The campaign routes victims through a three-layer redirection chain, tracks each visitor with a UUID assigned by a centralized server, and uses cloaking and wildcard DNS to evade defenders, with 93% of its domains resolving to 10 IP addresses and 84% registered through the reseller registrar eNom.

Key Takeaway: Unit 42 blocked an estimated 3.5 million sessions from this campaign across 74,711 devices in November 2023 alone, and its embedded JavaScript was found on more than 34,000 websites, most serving adult or streaming content. The payloads are adware and scareware rather than traditional malware, but Unit 42 notes they could give cybercriminals initial access that exposes victims to ransomware.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related