DriveSurge cluster spreads malware through fake update scams

A recent cybersecurity alert highlights the active DriveSurge threat cluster, a sophisticated operation compromising numerous websites through various malicious tactics. This Initial Access Broker (IAB) uses a Pay-Per-Install model, employing a Traffic Distribution System (zTDS) to deliver harmful scripts to unsuspecting visitors. The attackers deploy automated campaigns that impersonate software updates (FakeUpdates) and utilize social engineering techniques to execute malware.

Analysts have identified eight key technical fingerprints and suggested stringent security measures for organizations to defend against such threats, including regular audits and behavioral monitoring tools.