Kids in the Ad Fraud Crosshair: Why International Threat Actors are Targeting Children to Steal Money from Banks and Major Corporations

No ratings

Presented at BlackHat USA 2023 by

Zach Edwards

Cyber threat actors are scaling "Malicious Marketing as a Service" organizations with affiliates who hijack legitimate .gov, .edu and .org infrastructure in order to host scams that are crafted to show up on the first page of search results for specific phrases.These threat actors are explicitly targeting children and gamers, likely due to some lack of sophistication in that audience or a general "lack of criminal reporting" that occurs when a child is tricked into downloading malware or committing financial fraud.To make matters worse, this group is scaling up through affiliate software which claims publicly to have paid out more than $40 million to partners. This same software is now not only being used to target gamers, but someone is paying this network to prop up honeypots for people searching for recent anti-China / anti-CCP news articles.It's crucial for defenders and the public to understand not only the technical nuance of new exploits, but the psychological tactics used to get malware deployed at scale. For some threat groups, scale is acquired through sophistication and speed. For other threat groups, scale is acquired through persistence and psychological tricks that rely on people misunderstanding risks. This presentation will help folks understand a network that relies on both persistent psychological tricks as well as cutting edge malware and carefully crafted malicious data supply chains.