MalwarePublished 3 Nov 2025

Certified OysterLoader: Tracking Rhysida ransomware gang activity via code-signing certificates

Source AlienVault OTX General

Description

The Rhysida ransomware gang, previously known as Vice Society, is conducting a sophisticated malvertising campaign using Bing ads to distribute OysterLoader malware. This malware acts as an initial access tool, establishing persistence and enabling further payload deployment, including ransomware. The gang employs code-signing certificates, including Microsoft Trusted Signing, to evade detection and increase trustworthiness of their malware. Their activity has notably increased in 2025, with over 40 certificates tracked compared to 7 in 2024. They also utilize Latrodectus malware for initial access. The campaign leverages legitimate services and advanced evasion techniques, highlighting significant resource investment and operational maturity. This threat poses a medium severity risk but can lead to severe consequences if ransomware is deployed. European organizations should be vigilant against malvertising campaigns and suspicious software downloads, especially those impersonating popular software. Mitigation requires enhanced monitoring of code-signed binaries, user awareness, and blocking malicious ad traffic.

Impact

For European organizations, this threat poses a substantial risk primarily through initial compromise and subsequent ransomware deployment. The use of legitimate code-signing certificates and trusted advertising platforms increases the likelihood of successful infection, potentially bypassing traditional security controls. Once OysterLoader establishes persistence, attackers can deploy ransomware or other malicious payloads, leading to data encryption, operational disruption, financial loss, and reputational damage. The campaign's scale suggests potential targeting of high-value sectors such as healthcare, government, and critical infrastructure, which are prevalent in Europe. The use of malvertising also increases exposure to a broad range of users, including those in smaller organizations with less mature security postures. The sophistication of the threat actor and their evolving tactics indicate a persistent and adaptive adversary capable of causing significant harm if not mitigated effectively.

Defensive guidance

1. Implement advanced monitoring and detection for code-signed binaries, including verification of certificate legitimacy and revocation status. 2. Employ network-level controls to block or restrict access to known malicious domains and URLs associated with the campaign, including those identified via threat intelligence feeds. 3. Enhance endpoint detection and response (EDR) capabilities to identify behaviors consistent with OysterLoader and Latrodectus malware, such as unusual persistence mechanisms and process injection. 4. Conduct user awareness training focused on recognizing malvertising and the risks of downloading software from unverified sources, emphasizing caution with search engine ads. 5. Utilize application allowlisting to restrict execution of unauthorized or suspicious software, especially those lacking valid or expected code-signing certificates. 6. Regularly audit and monitor code-signing certificates within the organization to detect misuse or compromise. 7. Collaborate with advertising platforms and security vendors to report and take down malicious ads promptly. 8. Maintain up-to-date backups and incident response plans to mitigate ransomware impact if infection occurs.

Summary

The Rhysida ransomware gang, formerly Vice Society, is actively conducting a large-scale malvertising campaign using Bing search engine advertisements to lure victims to malicious landing pages that impersonate legitimate software download sites. The primary payload delivered is OysterLoader, a sophisticated initial access malware designed to establish a foothold on compromised devices and deploy persistent backdoors. OysterLoader is packed and signed with code-signing certificates, including those from Microsoft Trusted Signing, which helps the malware evade detection by security products and gain user trust. The gang's use of over 40 certificates in 2025, up from 7 in 2024, indicates an escalation in operational scale and sophistication. Additionally, Rhysida employs Latrodectus malware as another initial access vector. The campaign's reliance on legitimate platforms such as Bing ads and trusted code-signing certificates demonstrates a high level of resource investment and operational security. The malware uses multiple tactics and techniques mapped to MITRE ATT&CK, including initial access via spearphishing and exploitation (T1566.002, T1190), persistence (T1547), privilege escalation (T1055), defense evasion (T1140, T1027), and credential access (T1078). While no known exploits are currently reported in the wild, the threat's complexity and persistence mechanisms make it a significant risk for targeted organizations.

Indicators of compromise

Domains 7

cybersavvynetwork.com
doctorreportcard.com
funkyfirmware.com
teams-app.bet
teams-install.icu
techwisenetwork.com
veloraio.com

Hashes 473

01f5f41ee023828be958aab5dc797073
0909abec6b3e870fdf9b0a0ebb9eed25
0cdbd043aabe7693ac5ad1d476417910
0f3b6936ad1291260d840c43cb8b2e87
11c5d95d41cc658623751e8325aed3b8
12c4350f817f82719ac08fa9f454f881
18f4e64bed9155f7af47f6f315313e27
1d6f7d90630b62ec2a4a4bae3f62a182
1fddfa2071253cf865220a989088b5bb
210c35202bc5e9aceaaaa99ff4fe2360

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Nov 2025, 11:11 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details

Indicators of compromise

Domains 7

Hashes 473

Community reviews

Related threats