Security News > 2021 > October > Ransomware gangs use SEO poisoning to infect visitors
Researchers have spotted two campaigns linked to either the REvil ransomware gang or the SolarMarker backdoor that use SEO poisoning to serve payloads to targets.
SEO poisoning, also known as "Search poisoning," is an attack method that relies on optimizing websites using 'black hat' SEO techniques to rank higher in Google search results.
Due to their high ranking, victims who land on these sites believe they are legitimate, and actors enjoy a heavy influx of visitors who look for specific keywords.
According to the findings of the Menlo Security team, SEO poisoning by malware distributors is on the rise, with two notable examples being the Gootloader and SolarMarket campaigns.
The actors inject sites with keywords that cover over 2,000 unique search terms, including "Sports mental toughness," "Industrial hygiene walk-through," "Five levels of professional development evaluation," and more.
In the two campaigns spotted by the researchers, the actors didn't create their own malicious sites but instead hacked legitimate WordPress sites that already had a good Google search ranking.