{
  "family": "progressive",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware:Win32/Progressive (often associated with 'Progressive Web Apps' abuse or deceptive adware branding) is a classification for unwanted software that aggressively monitors user browsing habits to serve highly targeted, intrusive advertisements. It leverages both local system persistence and browser manipulation to generate fraudulent ad revenue or drive traffic to affiliate marketing sites (`T1189`).<br><br><b>Understanding Progressive (Adware)</b><br>To an end-user, Progressive severely disrupts the browsing experience. Users will encounter frequent pop-up ads, unexpected redirects when clicking legitimate links, and an overall slowing down of browser performance as the adware injects heavy JavaScript into every page visited. For a security team, it represents a data privacy issue and a potential gateway for malvertising attacks.<br><br><b>Execution and Persistence Mechanics</b><br>Progressive is commonly bundled with freeware, torrent downloads, or disguised as a necessary browser plugin. Once installed, it frequently establishes persistence by creating a Scheduled Task (`T1053.005`) that ensures the adware's core executable runs every time the user logs in. It then hooks into the browser processes or acts as a local proxy (`T1112`), intercepting all HTTP/HTTPS traffic. This allows it to inject its own advertising HTML/JavaScript directly into the Document Object Model (DOM) of the websites the user visits, bypassing many standard adblockers.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the loss of browsing privacy and exposure to potentially malicious third-party content. Host-based IoCs include the presence of unexpected scheduled tasks, unauthorized modifications to browser proxy settings, and the presence of unknown executables in `%ProgramFiles%` or `%LocalAppData%`. Network IoCs include a constant stream of background HTTP/HTTPS requests to known advertising networks, data brokers, and affiliate tracking domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Progressive and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Progressive is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Progressive establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Progressive typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Progressive compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Progressive should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Progressive leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Progressive frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Progressive maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Progressive often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1112",
    "T1053.005",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Distribution via deceptive software bundles)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task (Establishing persistent adware updaters)",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Modifying proxy settings to intercept and inject ads into web traffic)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows 'Programs and Features' control panel to uninstall the offending software and any recently installed 'free' applications.",
    "Run a comprehensive scan with a reputable Adware/PUP removal tool to catch any persistent registry keys or scheduled tasks left behind.",
    "Reset all web browsers (Chrome, Edge, Firefox) to their factory defaults to eliminate injected extensions and hijacked settings.",
    "Verify that the system's local proxy settings (`inetcpl.cpl` -> Connections -> LAN settings) have not been maliciously altered."
  ],
  "what_to_avoid": [
    "Do not ignore the adware; the advertising networks it uses are often poorly vetted and can serve drive-by exploit kits.",
    "Avoid clicking 'Next' rapidly during software installations without reading the EULA or unchecking 'Optional Offers'."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}