Malvertising Used as Entry Vector for BlackCat, Actors Also Leverage SpyBoy Terminator

The infection chain started with a malicious ad for the WinSCP application displayed in search engine results. Users who clicked on the ad were redirected to a cloned download webpage where they unknowingly downloaded a malware-infected ISO file.