New Seo Poisoning Campaign Targeting It Admins With Malware

Varonis reveals attackers are utilizing SEO poisoning to instrumentality IT admins into downloading malware, alongside a captious guidelines entree vulnerability successful Azure’s AZNFS-mount inferior affecting HPC/AI workloads. Update Azure immediately.

Cybersecurity researchers astatine Varonis person issued warnings connected 2 chopped but important threats targeting IT administrators and unreality infrastructure. Emerging wrong nan past 2 months, arsenic noted by Varonis successful a blog station published connected 2 May 2025, a increasing inclination of attackers utilizing SEO poisoning to instrumentality administrators into downloading malware disguised arsenic morganatic devices is observed.

Separately, connected May 6th, nan company’s Threat Labs reported a captious vulnerability successful a preinstalled Azure inferior that could let unprivileged users to summation afloat guidelines entree to unreality systems.

The SEO poisoning run involves cybercriminals manipulating hunt motor rankings to spot malicious websites astatine nan apical of results for communal IT management tools. Unsuspecting admins, believing they are downloading genuine software, alternatively instal malware that tin lead to nan installation of backdoors for illustration SMOKEDHAM, enabling persistent entree for attackers.

Varonis MDR Forensics squad members Tom Barnea and Simon Biggs highlighted cases wherever this method led to nan deployment of monitoring package for illustration a renamed type of Kickidler (grabber.exe), allowing attackers to secretly observe infected machines and bargain credentials.

Attack travel – Image credit: Varonis

This first entree often paves nan measurement for information exfiltration, arsenic seen successful 1 lawsuit wherever nan attackers successfully transferred astir a terabyte of information retired of nan network, followed by nan encryption of captious systems for illustration nan customer’s ESXi devices for ransom.

Ransom statement – Image credit: Varonis

In a abstracted but arsenic concerning discovery, Varonis Threat Labs, led by interrogator Tal Peleg, identified a captious flaw successful nan AZNFS-mount utility, a instrumentality preinstalled connected Azure High-Performance Computing (HPC) and Artificial Intelligence (AI) images. This vulnerability, affecting each versions up to 2.0.10, could let an mean personification to escalate their privileges to guidelines connected a Linux machine.

As per Veronis’ research, shared pinch Hackread.com, nan flaw exists successful nan “mount.aznfs” binary, which, owed to incorrect permissions, could beryllium exploited to execute arbitrary commands pinch nan highest strategy privileges. By manipulating a circumstantial situation variable, attackers could efficaciously return complete power of nan affected Azure systems.

Varonis Threat Labs responsibly disclosed this vulnerability to Microsoft Azure, which classified it arsenic debased severity. However, nan imaginable effect of gaining guidelines entree to unreality infrastructure is significant, arsenic it whitethorn let attackers to equine further storage, instal malware, and move laterally wrong unreality environments. Microsoft has since released a hole successful type 2.0.11 of nan AZNFS-mount utility.

Still, these findings show cybercriminals are perpetually improving their strategies for targeting captious IT infrastructure much effectively. The SEO poisoning run highlights nan request for amended consciousness among IT professionals erstwhile downloading devices from online searches, moreover those appearing highly ranked. The Azure inferior vulnerability emphasizes nan value of timely patching and observant configuration of unreality resources.

Varonis advises organizations to instrumentality a “Defense successful Depth” strategy, including worker training, endpoint security, web segmentation, and strict entree controls, to mitigate these increasing threats. Azure customers utilizing HPC images aliases NFS for Azure Storage are advised to update their AZNFS-mount inferior immediately.