{
  "family": "redirect",
  "sample_count": 16,
  "category": "advanced_threat",
  "description": "BrowserModifier:Win32/Redirect is a highly generic classification used to describe a wide variety of adware and browser hijackers that forcefully alter a user's web traffic routing. The primary goal is financial gain through affiliate marketing fraud, forcing the user to visit sponsored portals, advertising networks, or fake tech support scams.<br><br><b>Understanding Redirect</b><br>To an end-user, a Redirect infection is infuriating. When they attempt to visit Google or type a query into the address bar, they are instantly whisked away through a chain of unknown URLs, eventually landing on a low-quality search engine or a malicious popup. For security analysts, Redirect malware is a high-volume nuisance that relies on aggressive persistence mechanisms to lock the browser configuration, ensuring the attacker receives continuous pay-per-click revenue.<br><br><b>Execution and Hijacking Mechanics</b><br>Redirect variants are typically installed silently via software bundling (`T1189`) or malicious websites. Once executed, they employ multiple strategies to hijack the browser. The most common is the silent installation of malicious browser extensions (`T1176`). However, more advanced variants modify the Windows Registry (`T1112`) to alter the system's proxy settings (`T1090`), forcing all HTTP/HTTPS traffic through an attacker-controlled proxy server. They may also alter the local `hosts` file (`T1562.001`) to map popular domains (like facebook.com) to malicious IPs, or hijack the `.lnk` shortcut files on the desktop (`T1546`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, loss of productivity, and potential exposure to more severe malware via malvertising. Incident responders will observe anomalous DNS and HTTP traffic routing to known ad-tracking networks or rogue proxy servers. EDR logs will flag unauthorized modifications to the Windows Proxy registry keys (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings`) or the creation of local Group Policy Objects (GPOs) enforcing rogue extension installations.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1176",
    "T1090",
    "T1189",
    "T1546",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1090",
      "name": "Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution: Browser Shortcut Modification",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Open the Windows Internet Options and manually check the LAN Settings to disable any rogue proxy configurations established by the malware.",
    "Use enterprise endpoint management tools to forcefully remove all unrecognized browser extensions and reset the default search providers.",
    "Audit the properties of all browser shortcuts (`.lnk` files) on the user's Desktop and Taskbar to remove any appended malicious URLs.",
    "Check the local `hosts` file (`C:\\Windows\\System32\\drivers\\etc\\hosts`) for unauthorized DNS mappings and restore it to default."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's internal 'reset' button; if a system-level proxy is set, the browser reset will not fix the redirection issue.",
    "Avoid assuming the infection is harmless; aggressive redirect chains often end at Exploit Kits that can drop ransomware or banking trojans."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}