Actor Profile

DriveSurge is a threat actor conducting large-scale malware distribution operations. The actor leverages compromised website infrastructure at scale, utilizing thousands of sites to host and deliver malicious payloads. DriveSurge's motivation appears to be financially driven, focusing on mass infection through social engineering techniques. The actor employs ClickFix and FakeUpdate tactics, which are known methods for tricking users into executing malicious code under the guise of legitimate system updates or required actions.

TTPs (Tactics, Techniques, Procedures)

DriveSurge's primary TTPs center on initial access through compromised websites and social engineering. The actor uses ClickFix techniques (likely T1204.001 - User Execution: Malicious Link) to deceive victims into clicking malicious elements. FakeUpdate tactics involve masquerading malware as legitimate software updates (T1036 - Masquerading, T1189 - Drive-by Compromise). The large-scale compromise of thousands of websites suggests exploitation of web application vulnerabilities (T1190 - Exploit Public-Facing Application) or credential compromise (T1078 - Valid Accounts) for initial website access. The distribution infrastructure indicates sophisticated C2 and payload delivery mechanisms across a distributed network of compromised assets.

Targets & Patterns

DriveSurge employs an opportunistic, broad-spectrum targeting approach rather than focusing on specific sectors or geographic regions. By compromising thousands of websites, the actor casts a wide net to maximize victim reach across diverse demographics and industries. This indiscriminate targeting pattern is consistent with financially motivated cybercrime operations seeking volume over precision. Victims are likely selected based on their interaction with compromised websites rather than pre-determined criteria, suggesting the actor prioritizes scale and infection rates over targeted espionage or sector-specific objectives.

Historical Context

ClickFix and FakeUpdate techniques have been widely adopted across the cybercrime ecosystem for several years. FakeUpdate (also tracked as SocGholish by some vendors) has been a persistent threat vector since at least 2018, often linked to initial access brokers and ransomware affiliates. The use of these established techniques by DriveSurge indicates the actor is leveraging proven social engineering methods. The scale of website compromises—thousands of sites—suggests either a mature operation with significant resources or collaboration with access brokers who specialize in website compromise. Without additional reporting, direct links to previous named campaigns cannot be established, though the TTPs align with broader trends in commodity malware distribution.

Defensive Recommendations

  • Monitor for suspicious JavaScript injection on web properties, particularly scripts mimicking browser or system update prompts (T1189 detection)
  • Implement user awareness training focused on recognizing fake update prompts and ClickFix social engineering tactics, emphasizing verification through official channels
  • Deploy web application firewalls (WAF) and conduct regular vulnerability assessments of public-facing web infrastructure to prevent compromise (T1190 mitigation)
  • Enable endpoint detection for execution of scripts downloaded from browsers, particularly PowerShell, JavaScript, or HTA files originating from web sources (T1204.001, T1059 detection)
  • Monitor network traffic for connections to known FakeUpdate and ClickFix C2 infrastructure using threat intelligence feeds and block at perimeter