Stage Capabilities: SEO Poisoning

Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.[1][2]


To help facilitate Drive-by Compromise, adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as Drive-by Target) within search engines. Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites. These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news).[3][1]

攻撃者は、Drive-by Compromiseを促進するために、悪意のあるペイロード(Drive-by Targetなど)をホストするサイトを検索エンジン内で上位表示させるために、SEOランキングを明示的に操作するコンテンツを作成する場合があります。SEO ランキングの汚染には、侵害されたサイトへのキーワードの詰め込み(隠しテキストの形式を含む)など、さまざまなトリックが含まれることがあります。これらのキーワードは、標的となる被害者の興味や閲覧習慣に関連するものであったり、より広範で時期的に人気のあるトピック(選挙、トレンドニュースなど)であったりします[3][1]。

Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation.[2][4]


SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.[3][5]


ID: T1608.006
Sub-technique of:  T1608
Platforms: PRE
Contributors: Goldstein Menachem; Vijay Lalwani; Will Jolliffe; Will Thomas, Equinix Threat Analysis Center (ETAC)
Version: 1.0
Created: 30 September 2022
Last Modified: 27 October 2022


ID Mitigation Description
M1056 Pre-compromise

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.


ID Data Source Data Component Detects
DS0035 Internet Scan Response Content

If infrastructure or patterns in the malicious web content related to SEO poisoning or Drive-by Target have been previously identified, internet scanning may uncover when an adversary has staged web content supporting a strategic web compromise. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on other phases of the adversary lifecycle, such as Drive-by Compromise or Exploitation for Client Execution.