An undetermined threat actor was observed weaponizing a cluster of domains masquerading as legitimate IP scanner software sites to distribute malware via a previously unseen Windows backdoor. In a blog post April 17, Zscaler ThreatLabz said the threat actor registered multiple look-alike domains using a typosquatting technique and leveraged Google Ads to push these fraudulent domains to the top of search engine results targeting specific search keywords, thereby luring potential victims to these IP scanner sites.

Source: SC Magazine