The Rhysida ransomware gang, previously known as Vice Society, is conducting a sophisticated malvertising campaign using Bing ads to distribute OysterLoader malware. This malware acts as an initial access tool, establishing persistence and enabling further payload deployment, including ransomware. The gang employs code-signing certificates, including Microsoft Trusted Signing, to evade detection and increase trustworthiness of their malware. Their activity has notably increased in 2025, with over 40 certificates tracked compared to 7 in 2024. They also utilize Latrodectus malware for initial access. The campaign leverages legitimate services and advanced evasion techniques, highlighting significant resource investment and operational maturity. This threat poses a medium severity risk but can lead to severe consequences if ransomware is deployed. European organizations should be vigilant against malvertising campaigns and suspicious software downloads, especially those impersonating popular software. Mitigation requires enhanced monitoring of code-signed binaries, user awareness, and blocking malicious ad traffic.
