The BlackCat ransomware utilizes WinSCP search ads to distribute Cobalt Strike