Ad Bidding Network Abused for Ransomware Delivery in “Fessleak” Attacks

Researchers at Invincea have been monitoring a malvertising campaign in which malicious actors leveraged Adobe Flash Player exploits and file-less infections to deliver ransomware.

The campaign, dubbed “Fessleak” based on the email address used to register the domains involved in the attack, appears to be the work of Russian cybercriminals.

In the first phase of the operation, the attackers register a so-called “burner” domain whose DNS is set up to be live for just 8 hours. This domain is then pointed to a hardened malicious landing page that is set up to serve ransomware. In order to get users to this landing page, the cybercrooks use real-time ad bidding to promote the burner domain.

Real-time bidding allows advertising buyers to bid on an impression. If the bid is won, their ad is instantly displayed on the publisher’s website.

In the case of Fessleak, the burner domain is abandoned after 8 hours and the process is repeated. Domains last only as long as it takes to update the proxy blacklist, and the entire attack process can be scripted, Invincea said.

According to the security firm, the malvertising campaign has affected a large number of websites, including huffingtonpost.com, answers.com, CBSsports.com, thesaurus.com, jpost.com, photobucket.com, and match.com.

Initially, the attackers used file-less infections to deliver the malware.

“You will see in the logs that there is no dropped file, however, you will see that the malware is extracted from system memory using the local System32 file, extrac32.exe,” Invincea said in a blog post.

After Microsoft patched a privilege escalation vulnerability (CVE-2015-0016) in Windows, the attackers stopped using file-less infections.

“Now Fessleak drops a temp file via flash and makes calls to icacls.exe, the file that sets permissions on folders and files. At this time, there is no detection for the malicious binary, which likely rotates its hash value to avoid AV detection,” Invincea said.

The cybercriminals are now using two recently patched Adobe Flash Player vulnerabilities (CVE-2015-0311 and CVE-2015-0313) to deliver ransomware and ad fraud malware. Trend Micro observed the same threat actors using CVE-2015-0313 to deliver malware via ads on the popular video sharing website Dailymotion.

Exploits for CVE-2015-0311 and CVE-2015-0313 were initially spotted only in the Angler exploit kit. However, CVE-2015-0313 is now also included in the Hanjuan exploit kit, while CVE-2015-0311 has been spotted by French researcher Kafeine in RIG, Fiesta and Nuclear Pack as well.