{
  "family": "sciagnij",
  "sample_count": 6,
  "category": "advanced_threat",
  "description": "Adware:Win32/Sciagnij is a Potentially Unwanted Program (PUA) and adware downloader. It typically masquerades as a legitimate download manager or file sharing utility on Polish-language software portals (the name derives from the Polish word for 'download'). Instead of cleanly downloading the requested file, Sciagnij functions as an aggressive Pay-Per-Install (PPI) bundler, intercepting the download process to silently install a payload of browser hijackers, toolbars, and tracking adware alongside the desired software.<br><br><b>Understanding Sciagnij</b><br>To an end-user, Sciagnij is highly deceptive. They believe they are downloading a free game or utility, but the executable they receive is actually the Sciagnij wrapper. For a security operations center (SOC), Sciagnij represents a failure in user education regarding 'Dark Patterns' and safe downloading practices. While not a destructive virus, it introduces numerous unvetted, third-party applications into the enterprise environment.<br><br><b>Execution and Bundling Mechanics</b><br>Sciagnij is distributed via deceptive advertising (`T1189`) on freeware sites. When executed (`T1204.002`), it presents an installation wizard that utilizes confusing UI layouts and pre-checked boxes to gain 'consent' for secondary software installations. Once running, it reaches out to its command-and-control infrastructure (the PPI network) to retrieve the latest payload of adware (`T1105`). It installs rogue Browser Helper Objects (BHOs) (`T1176`), alters the default search engine (`T1185`), and drops multiple tracking cookies. Finally, it may actually download the originally requested file to maintain the illusion of legitimacy.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, compromised browser privacy, and the introduction of potentially vulnerable third-party code. IoCs include EDR alerts for unsigned executables dropping multiple secondary MSIs or EXEs into the `%Temp%` directory. Network logs will show traffic to known Polish or international PPI networks and ad-tracking domains during the installation phase. The presence of newly installed, unknown browser extensions is a key host-based indicator.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1176",
    "T1105",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Deceptive download portals)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Running the deceptive wrapper)",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the bundled adware)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing rogue BHOs)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to meticulously uninstall all unknown software that was installed on the same date as the Sciagnij detection.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip deeply embedded registry hooks and force-installed extensions.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the default search engine.",
    "Block access to the specific freeware distribution portals where the user originally downloaded the wrapper."
  ],
  "what_to_avoid": [
    "Do not rely solely on the user to 'uncheck' boxes during installation; enterprise policy should block the execution of known bundlers entirely.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities to third-party data brokers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}