Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Spotlight: Spin to Win...Malware

Summary: Cisco Talos documented large-scale malvertising campaigns in which a spoofed German-language gambling ad for spinpalace.com carried buried JavaScript that redirected users to Angler and Rig exploit kit landing pages, with the redirect script served as cookie.php from the hard-coded IP 217.23.5.123 under varying subfolders. Most delivered payloads were ransomware variants including Teslacrypt and Cryptowall, alongside an outlier downloader that called the hard-coded IP 84.19.27.27 and used HTTP status codes, including a 404 response returning more than 400KB of data, to drive its command-and-control activity.

What's compelling: No click was required: users were infected simply by viewing a page hosting the ad, reached through searches for anime, movie and sports streams, and the ad networks could not catch it because the landing page was benign when scanned and the malicious content sat behind multiple tiers of redirection.

Read the original at Cisco Talos ↗

Topics
Malware
Related