{
  "family": "eorezo",
  "sample_count": 271,
  "category": "advanced_threat",
  "description": "Adware:Win32/Eorezo is a massive, highly organized adware and browser hijacker network, originating primarily in France, that aggressively monetizes infected endpoints through forced advertisements.<br><br><b>Understanding Eorezo</b><br>To the end-user, Eorezo renders a computer nearly unusable by injecting in-text hyperlinks, pop-up ads, and fake security warnings into every visited webpage, while locking the homepage to a French affiliate search engine. For security analysts, Eorezo represents a severe compromise of the browser's security boundary. It acts as a Man-in-the-Browser (MitB), utilizing local proxies and rogue root certificates to intercept and decrypt SSL/TLS traffic.<br><br><b>Execution and Evasion Strategies</b><br>Eorezo is distributed via pay-per-install (PPI) software bundlers, often attached to fake Java updates or pirated software. Once installed, it drops its toolbars (like 'PCTuto' or 'SoftwareUpdate') and rogue extensions across all browsers. It establishes persistence by modifying the Windows Internet Options to route all traffic through a local proxy controlled by the adware. It protects its components by installing a Windows Service that actively monitors the registry; if a user attempts to remove the proxy settings, the service instantly reverts them.<br><br><b>Indicators of Compromise (IoCs)</b><br>Incident responders should immediately audit the Windows Certificate Store for unauthorized, self-signed Root CAs, which Eorezo uses to facilitate its HTTPS interception. Threat hunters will find anomalous proxy configurations in the registry (<code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings</code>). Network logs will reveal massive volumes of HTTP GET requests directed at known ad-tracking networks based in France.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1543.003",
    "T1185",
    "T1556",
    "T1189",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1556",
      "name": "Modify Authentication Process",
      "tactic": "Credential Access"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the exfiltration of intercepted web traffic and prevent further click-fraud.",
    "Open the Windows Certificate Manager (certmgr.msc) and forcefully delete any rogue Root Certificates installed by Eorezo.",
    "Remove the unauthorized local proxy configuration from Windows Internet Options and flush the DNS cache.",
    "Audit the Windows Services (services.msc) to identify and disable the watchdog service protecting the adware."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into secure corporate or financial portals while infected, as Eorezo decrypts and inspects all SSL traffic.",
    "Avoid relying solely on Chrome's extension manager for removal; the local proxy and Windows Service must be neutralized first."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}