Acquire Infrastructure: Malvertising (T1583.008) is a resource development technique. MITRE tags it with the PRE platform, because the buying of ads happens before any victim is reached.
The danger is trust. People trust the first result in a search for a tool they need, and an ad can sit exactly there.
How attackers use it
MITRE says adversaries may purchase online advertisements that are abused to distribute malware. Ads can plant, and favorably position, malicious artifacts in prominent spots such as search engine results. That makes real results harder to tell from advertisements.
The page describes several things adversaries may do:
- Impersonate or spoof well-known brands. A spoofed ad can send the victim to a malicious domain that clones an official website and offers a trojanized version of the advertised software.
- Target specific audiences, using the ad network's own targeting features.
- Automate the creation of malicious domains and ad purchases at scale, which helps them resist cleanup.
- Evade the ad network's review. MITRE notes that adversaries may route automated crawler and policy enforcement traffic to benign sites while sending visitors who arrived from real ad clicks to malicious pages.
Malvertising can also support drive-by activity. If the ad contains code or exploits, it may infect the browser with limited user interaction.
How to detect it
MITRE says that if infrastructure or patterns in the malicious web content have been identified before, internet scanning may reveal when an adversary has staged malicious content. It also says most of this activity is outside the visibility of the target organization, and recommends focusing on later stages such as Drive-by Compromise and Exploitation for Client Execution.
In practice, that points to endpoint and network telemetry:
- Downloads of installers from domains that are not the vendor's official domain, especially soon after a browser visit that began with a search.
- Newly registered or very young domains in proxy logs, followed by an executable download.
- Browser processes spawning installers or script interpreters.
- Reports from staff who clicked a sponsored result. Make it easy to report one and treat reports as signals.
The interesting detail is that the ad network may never see the malicious page. A takedown request often needs the final landing page, so capture it, with the full redirect chain, when you receive a report.
Click through it at your own pace, or open it full screen.
How to reduce the risk
MITRE's mitigation entry for this technique is Pre-compromise, and it adds a specific note: efforts should focus on initial access activities such as drive-by compromise, where ad blockers can help prevent malicious code from executing.
Steps that follow from that:
- Deploy a reputable ad blocker through browser management on managed devices. This is the control MITRE names.
- Send staff to official download pages by bookmark or internal software catalog, not by search.
- Allow software installation only from approved sources, and require approval for new installers.
- Keep browsers and plugins patched so that a drive-by has less to work with.
- For developers, the same habit applies to packages and tools. A typosquatted package is the dependency version of a cloned download page.
A short plan for the first month helps, because malvertising defense is mostly habit.
In week one, decide on the ad blocker and push it to managed browsers. In week two, publish the internal software catalog and tell staff it is the first stop for any download. In week three, add a detection that flags installer downloads from domains outside an approved list. In week four, run a small exercise: send staff a harmless internal test page that mimics a download portal and see how many report it.
Measure two things only. How many staff reported a suspicious ad or download page, and how long it took to capture the landing page. Both numbers should improve, and both are cheap to track.
One more point on responding. When someone does install a trojanized download, treat it as a full endpoint compromise. Isolate the host, collect the installer and its hash, reset credentials used on that machine, and check what else the same user downloaded that day. The ad that caught one person probably caught others.
Developers and administrators should apply the same care to tools they fetch from the command line. Searching for a utility and picking the top sponsored link is the same mistake as clicking an ad for a PDF editor. Use the vendor's documented download location, verify the checksum or signature the vendor publishes where one exists, and install through your package manager or software catalog when possible.
Check your own environment
- Does your managed browser configuration include an ad blocker? If not, who owns that decision?
- Do staff have an internal catalog for common tools such as remote access clients, PDF editors and archive utilities?
- Can you list installer executables downloaded to endpoints in the last 30 days, with the source domain? Most EDR and proxy products can.
- Is there a one-click way to report a suspicious ad, and is the report routed to someone who captures the landing page?
- Windows, PowerShell, read-only:
Get-AuthenticodeSignature .\installer.exeshows whether a downloaded file is signed and by whom.
Quick check
Why can adversaries avoid review by the ad network?
MITRE notes they may route crawler and policy enforcement traffic to benign pages, and send real ad click visitors to malicious ones.
Which control does MITRE name for this technique?
Ad blockers, as part of focusing on initial access activities such as drive-by compromise.
Is it practical to detect the ad purchase itself?
No. It happens outside your visibility. Detect the follow-on download or drive-by instead.
