{'created': '2023-02-21T20:46:57.170Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may purchase online advertisements that can be '
                'abused to distribute malware to victims. Ads can be purchased '
                'to plant as well as favorably position artifacts in specific '
                'locations  online, such as prominently placed within search '
                'engine results. These ads may make it more difficult for '
                'users to distinguish between actual search results and '
                'advertisements.(Citation: spamhaus-malvertising) Purchased '
                'ads may also target specific audiences using the advertising '
                'network’s capabilities, potentially further taking advantage '
                'of the trust inherently given to search engines and popular '
                'websites. \n'
                '\n'
                'Adversaries may purchase ads and other resources to help '
                'distribute artifacts containing malicious code to victims. '
                'Purchased ads may attempt to impersonate or spoof well-known '
                'brands. For example, these spoofed ads may trick victims into '
                'clicking the ad which could then send them to a malicious '
                'domain that may be a clone of official websites containing '
                'trojanized versions of the advertised software.(Citation: '
                'Masquerads-Guardio)(Citation: FBI-search) Adversary’s efforts '
                'to create malicious domains and purchase advertisements may '
                'also be automated at scale to better resist cleanup '
                'efforts.(Citation: sentinelone-malvertising) \n'
                '\n'
                'Malvertising may be used to support [Drive-by '
                'Target](https://attack.mitre.org/techniques/T1608/004) and '
                '[Drive-by '
                'Compromise](https://attack.mitre.org/techniques/T1189), '
                'potentially requiring limited interaction from the user if '
                "the ad contains code/exploits that infect the target system's "
                'web browser.(Citation: BBC-malvertising)\n'
                '\n'
                'Adversaries may also employ several techniques to evade '
                'detection by the advertising network. For example, '
                'adversaries may dynamically route ad clicks to send automated '
                'crawler/policy enforcer traffic to benign sites while '
                'validating potential targets then sending victims referred '
                'from real ad clicks to malicious pages. This infection vector '
                'may therefore remain hidden from the ad network as well as '
                'any visitor not reaching the malicious sites with a valid '
                'identifier from clicking on the advertisement.(Citation: '
                'Masquerads-Guardio) Other tricks, such as intentional typos '
                'to avoid brand reputation monitoring, may also be used to '
                'evade automated detection.(Citation: spamhaus-malvertising) ',
 'external_references': [{'external_id': 'T1583.008',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1583/008'},
                         {'description': 'BBC. (2011, March 29). Spotify ads '
                                         'hit by malware attack. Retrieved '
                                         'February 21, 2023.',
                          'source_name': 'BBC-malvertising',
                          'url': 'https://www.bbc.com/news/technology-12891182'},
                         {'description': 'FBI. (2022, December 21). Cyber '
                                         'Criminals Impersonating Brands Using '
                                         'Search Engine Advertisement Services '
                                         'to Defraud Users. Retrieved February '
                                         '21, 2023.',
                          'source_name': 'FBI-search',
                          'url': 'https://www.ic3.gov/Media/Y2022/PSA221221'},
                         {'description': 'Hegel, Tom. (2023, January 19). '
                                         'Breaking Down the SEO Poisoning '
                                         'Attack | How Attackers Are Hijacking '
                                         'Search Results. Retrieved February '
                                         '21, 2023.',
                          'source_name': 'sentinelone-malvertising',
                          'url': 'https://www.sentinelone.com/blog/breaking-down-the-seo-poisoning-attack-how-attackers-are-hijacking-search-results/'},
                         {'description': 'Miller, Sarah. (2023, February 2). A '
                                         'surge of malvertising across Google '
                                         'Ads is distributing dangerous '
                                         'malware. Retrieved February 21, '
                                         '2023.',
                          'source_name': 'spamhaus-malvertising',
                          'url': 'https://www.spamhaus.com/resource-center/a-surge-of-malvertising-across-google-ads-is-distributing-dangerous-malware/'},
                         {'description': 'Tal, Nati. (2022, December 28). '
                                         '“MasquerAds” — Google’s Ad-Words '
                                         'Massively Abused by Threat Actors, '
                                         'Targeting Organizations, GPUs and '
                                         'Crypto Wallets. Retrieved February '
                                         '21, 2023.',
                          'source_name': 'Masquerads-Guardio',
                          'url': 'https://labs.guard.io/masquerads-googles-ad-words-massively-abused-by-threat-actors-targeting-organizations-gpus-42ae73ee8a1e'}],
 'id': 'attack-pattern--155207c0-7f53-4f13-a06b-0a9907ef5096',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'resource-development'}],
 'modified': '2025-04-15T22:47:29.928Z',
 'name': 'Malvertising',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Tom Hegel',
                          'Menachem Goldstein',
                          'Hiroki Nagahama, NEC Corporation',
                          'Manikantan Srinivasan, NEC Corporation India',
                          'Pooja Natarajan, NEC Corporation India',
                          'Juan Carlos Campuzano - Mnemo-CERT'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['PRE'],
 'x_mitre_version': '1.0'}