How to Stop a Malware Campaign That Can Shift Its Infrastructure

MSPs are used to blocking malicious domains, detecting suspicious IP addresses, and continuously updating their defenses against emerging threats. However, what happens when attackers can shift their infrastructure in near real-time without interrupting the campaign?

The ErrTraffic campaign, analyzed by the WatchGuard Threat Lab, provides an example of how malware distribution techniques are evolving. Instead of relying on static infrastructure, threat actors use decentralized services to dynamically update the resources needed to keep the infection active.

For MSPs, these types of threats pose a major challenge: defense strategies based exclusively on indicators of compromise (IoCs) can quickly become obsolete when attackers are able to replace compromised resources at high speed.

ErrTraffic uses compromised websites to display fake error messages designed to trick victims into running a supposed technical fix. Through a technique known as ClickFix, the user copies and executes a PowerShell command that initiates the malware download.

What makes this campaign particularly interesting is its use of EtherHiding to query information stored in a smart contract on a public blockchain. The malware then retrieves the updated location of the infrastructure needed to keep the infection going.

In practice, this means attackers can swap out compromised servers without altering the rest of the attack chain, frustrating traditional blocking strategies and extending the window during which the campaign remains active.

 Blocking an Address Doesn't Shut Down the Campaign

Blocking a domain or an IP address cuts off communication with the active resource. However, in a campaign that uses EtherHiding, that server is a replaceable element. Blocking it doesn’t eliminate the mechanism that enables the malware to locate the next one.

For MSPs, this reality highlights an increasingly clear trend: modern defense cannot rely solely on identifying known malicious infrastructure. It must be capable of detecting suspicious behavior regardless of where the threat originates.

This doesn’t mean indicators are no longer useful. They make it possible to block known connections, locate affected devices, and investigate past activity. That said, to ensure the response doesn’t depend on a specific address remaining active, indicators must be paired with controls capable of stopping the campaign at other phases of the infection. Service providers need to incorporate controls that operate beyond simple domain or IP address reputation.

An Opportunity to Strengthen the MSP's Value Proposition

Even if the infrastructure shifts, ErrTraffic still needs to guide the user to the compromised site, display the fake error message, convince them to run the command, download a payload, and initiate malicious activity on the device. Each of these phases offers an opportunity to stop it.

This is where a multi-layered security approach allows MSPs to offer their clients more resilient and differentiated protection.

Network security can block malicious sites and DNS requests, analyze resource reputation, inspect traffic, detect intrusion attempts, and examine payloads trying to reach the device. Sandboxing also makes it possible to analyze unknown files before they enter the environment. Consequently, changing servers might invalidate a specific block, but it doesn’t prevent the campaign from having to communicate and deliver the malware.

For an MSP, this provides a first line of defense capable of stopping a substantial amount of malicious activity automatically and across multiple clients at scale.

However, ClickFix attempts to trick the user directly into running a command on their device. If the payload manages to reach the system, it can download files, launch unauthorized processes, or install remote access tools. That’s when endpoint security makes all the difference. Behavioral detection analyzes activity on the host, meaning it doesn’t rely solely on recognizing the file, domain, or server. In addition, it makes it possible to block fileless threats and zero-day attacks, isolate the affected endpoint, and analyze root cause.

From the MSP's perspective, this visibility means they can detect activities that traditional blocklists would never identify on their own.

Modern campaigns demonstrate that threat actors no longer need to rely on static infrastructure. They can quickly swap out compromised domains, servers, and resources to keep the campaign running longer.

For this reason, the most effective MSPs don’t base their services solely on blocking known threats. Their value lies in combining visibility, automation, and multi-layered controls capable of detecting malicious activity even when the infrastructure changes.

Combining both layers prevents the response from depending on successfully blocking a single component of the infrastructure. If attackers replace that resource, the campaign is still exposed to controls at other stages of the infection. As a result, defense stops chasing every new address and focuses on disrupting the attack chain. In the face of dynamic infrastructure, the best response is the ability to stop the threat, even when the resources used to distribute it shift.