Attackers Turn Digital Analytics Tools into Weapons, Experts Warn
In a recent report, cybersecurity researchers from Mandiant and Google Cloud have shed light on the alarming trend of threat actors repurposing digital analytics and advertising tools for malicious purposes. These tools, originally designed to enhance user experience and streamline marketing efforts, are now being co-opted to evade detection and amplify the impact of cyberattacks.
The report highlights the concept of “malnalytics,” where attackers exploit the very tools that companies use to track user engagement and analyze traffic. By repurposing digital analytics, threat actors can obscure their activities, making it more difficult for traditional security measures to detect malicious campaigns. This technique not only increases the effectiveness of attacks but also allows attackers to maintain a level of anonymity and persistence within a compromised network.
bit.ly destination URL configuration
One of the most striking examples from the report is the misuse of link shorteners. Widely used in digital marketing to condense lengthy URLs and track click-through rates, link shorteners have become a favored tool for cybercriminals. Mandiant researchers have observed threat actors using these services to disguise the URLs of malicious landing pages. For instance, during the initial access phase of an attack, a link shortener might redirect a victim to a phishing page, effectively masking the true destination and increasing the likelihood of a successful attack.
In one documented case, a financially motivated threat actor used link shorteners in a series of SMS phishing campaigns between 2021 and 2022. These campaigns funneled victims through a maze of device, location, and browser checks before presenting a form designed to steal credit card information. Similarly, in a 2023 malvertising campaign, link shorteners were employed to track clicks on Dropbox URLs hosting malware payloads.
The report also discusses how IP geolocation utilities, typically used by advertisers to gauge the reach of their campaigns, have been weaponized by attackers. These utilities allow attackers to tailor their malicious actions based on the geographical location of the victim. For example, the Kraken Ransomware used geolocation services to track the spread of infections, while the TURKEYDROP variant of the Adwind malware targeted systems located in Turkey specifically.
This capability not only enables more precise targeting but also helps attackers avoid detection by limiting the geographical scope of their campaigns. For instance, if an attacker wishes to avoid targeting certain countries, they can configure their malware to only activate if the victim’s IP address falls within a specific range.
CAPTCHA services, designed to distinguish between human and automated activity, are another tool that has been subverted by cybercriminals. The report reveals how attackers use CAPTCHA challenges to prevent security tools from accessing and scanning their malicious infrastructure. By screening out non-human traffic, such as security bots and automated analysis tools, attackers can ensure that their phishing pages or malware remain accessible only to real users.
One notable case involved the FIN11 group, which used CAPTCHA challenges in a phishing campaign to deliver malware, effectively bypassing automated detection mechanisms.
Given the widespread use of these digital tools, completely blocking them is not a viable option for most organizations. Instead, the report suggests implementing automated analysis and monitoring for suspicious behaviors associated with these tools. For example, organizations can look for patterns such as a shortened URL redirecting to multiple different URLs in quick succession or an IP geolocation utility being used by non-browser processes on endpoints.
By understanding how these tools are being weaponized, organizations can better defend against these evolving threats. The report serves as a critical reminder that the same tools used to enhance digital marketing and analytics can also be turned against us, highlighting the need for vigilance and advanced security measures in today’s digital landscape.
