Hackers Poison Google Search Results to Deliver Zeus Panda

Threat actors leverage SEO to ensure malicious links rank highly in Google results to infect targets with Trojan.

Most people use Google to search for answers but dont know the results arent always safe. Attackers have begun to exploit this reliance on Google by using Search Engine Optimization (SEO) to populate search results with malicious links and distribute the Zeus Panda Banking Trojan through a compromised Word document.
SEO enables hackers to make their links more dominant in search results. In this case, attackers are poisoning the results for specific keywords related to banking and finance, effectively narrowing their victim pool to a specific group so they can steal financial information.
SEO poisoning by itself isnt really new, says Earl Carter, threat researcher for Cisco Talos and one of the authors who
detailed
this discovery. People have always been trying to manipulate search results. What was unique is theyre using it in the distribution of malware.
Based on the keywords used, it seems the attackers are targeting geographic regions. Some examples of targeted keyword searches include nordea sweden bank account number, al rajhi bank working hours during ramadan, and sbi bank recurring deposit form.
In this campaign, hackers used compromised Web servers to ensure malicious links will appear prominently in these searches. Most of the time, they successfully displayed several poisoned links on the first results page. The links seemed unsuspicious because attackers hid their activity under compromised business websites that already had ratings and reviews.
As user awareness training becomes more common, [users] are less likely to open unexpected attachments, but those same users may be likely to click result number one on a Google result page, says Talos threat researcher Edmund Brumaghin. Researchers checked other search engines and concluded Google is the attackers key focus.
Users who browse pages hosted on compromised servers kick-start a multi-stage malware infection. The same redirection and infrastructure has been seen in other attacks; for example, fake antivirus and tech support scams in which users are asked to call a phone number.
Ultimately, targets are redirected to a site hosting a malicious Word document. The doc contains malicious macros that execute when users download and click Enable Content.
Whats inside
Researchers determined the malicious payload in this campaign seems to be a new version of the Zeus Panda banking Trojan, which steals sensitive data like banking information. The sample Talos analyzed is a multi-stage malware payload in which the initial stage has several anti-analysis techniques and prolonged execution to evade detection. While its functionality is still the same, the evasion techniques make it harder for reverse engineers to figure out.
This malware first queries the systems keyboard mapping to determine its language, and terminates if it detects Russian, Belarusian, Kazak, or Ukrainian. Earlier
analysis
of Zeus Panda also revealed it wouldnt run on systems in Russia, Ukraine, Belarus, or Kazakhstan.
Zeus Panda checks to verify whether its running within hypervisor or sandbox environments including VMware, VirtualPC, VirtualBox, Parallels, Sandboxie, Wine, or SoftIce. Finally, the malware scans for tools commonly used among analysts for investigating malicious software. If any of these checks turn up positive, the malware removes itself from the machine.
Researchers cant say with certainty whether the Zeus Panda threat actors are also behind this campaign. The same threat actors, over time, constantly try to find new ways to get in, says Carter. It could be the same guys, it could be different guys.
Alternatively, they say, this distribution mechanism could be the work of threat actors who are farming it out to attackers who want to spread different forms of malware, similar to how the Necurs botnet distributes various campaigns via email.
Carter and Brumaghin emphasize the importance of building on user awareness training to include verifying whether links are trusted. Just because a site appeared high in Google search doesnt mean its safe.
Make sure you know what site youre going to when you go to a Google result, or result in any search engine, says Brumaghin.
Related Content:
Silence Trojan Mimics Carbanak to Spy, Steal from Banks
Consumers Dont Trust Businesses Can Protect Their Data
Social Engineer Spills Tricks of the Trade
10 Mistakes End Users Make That Drive Security Managers Crazy
Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity
agenda here
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Hackers Poison Google Search Results to Deliver Zeus Panda