ask-partner-network

Ask Partner Network update channel delivered fileless malware

Carbon Black and Red Canary disclosed in late 2017 that the Ask Partner Network (APN) — the update infrastructure behind the Ask.com Toolbar bundled with many freeware installers — was abused to push a multi-stage fileless malware loader through its official update channel. Endpoints with the Ask Toolbar installed received the malicious update via the trusted updater process, complicating detection. The campaign was characterized as targeted, with downstream payloads tailored to specific organizations rather than mass cryptojacking. APN/IAC pushed a clean update after notification.