Menu
Long-running malvertising campaign infected thousands of computers per day

Long-running malvertising campaign infected thousands of computers per day

The AdGholas malvertising operation tricked ad networks and malware scanners using steganography

Security researchers have shut down a large-scale malvertising operation that used sophisticated techniques to remain undetected for months and served exploits to millions of computers.

The operation, dubbed AdGholas, has been running since at least October 2015. According to security vendor Proofpoint, the gang behind it managed to distribute malicious advertisements through more than 100 ad exchanges, attracting between 1 million and 5 million page hits per day.

The Proofpoint researchers estimate that 10 to 20 percent of computers that loaded the rogue ads were redirected to servers hosting exploit kits -- web-based attack tools that attempt to silently exploit vulnerabilities in popular applications in order to install malware.

The malvertising code used a series of complex checks to ensure that the visiting computers are not virtual machines used by security researchers or by ad networks themselves to discover malware.

Other checks were used to filter victims based on their geolocation and to serve certain malware programs, typically online banking Trojans, only to users in specific regions. This was likely done on request by the cybercriminal gangs behind those Trojans that paid the AdGholas group to distribute their malware.

In order to make it even harder for ad networks and security scanners to discover the attacks, the AdGholas group used steganography -- the technique of hiding code inside images. The rogue ads contained images with encrypted JavaScript code inside that was only extracted and executed for selected computers passing the required checks.

This is the first time when the use of steganography has been observed in a malvertising attack, according to Proofpoint. The company's researchers worked with researchers from Trend Micro to deconstruct the attackers' technique and analyze it.

Proofpoint estimates that the AdGholas malvertising campaigns hit up to 1 million computers every day and infected thousands of them with malware. The operation was suspended on July 20 following action from members of the advertising industry.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Featured

Slideshows

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

This exclusive Reseller News Exchange event in Auckland explored the challenges facing the partner community on the cloud security frontier, as well as market trends, customer priorities and how the channel can capitalise on the opportunities available. In association with Arrow, Bitdefender, Exclusive Networks, Fortinet and Palo Alto Networks. Photos by Gino Demeer.

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security
Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomed 2019 inductees - Leanne Buer, Ross Jenkins and Terry Dunn - to the fourth running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing face of the IT channel ecosystem in New Zealand and what it means to be a Reseller News Hall of Fame inductee. Photos by Gino Demeer.

Reseller News welcomes industry figures at 2020 Hall of Fame lunch
Show Comments