A stealthy malvertising campaign has been flying under the radar for the last few months, targeting millions of readers visiting popular and mainstream news sites. The campaign is notable for stealth bordering on paranoia from the threat group, probably AdGholas.
In July 2016, Proofpoint published an analysis of a massive AdGholas malvertising campaign that it described as “using a sophisticated combination of techniques including sophisticated filtering and steganography.” It added that AdGholas had ceased operation following exposure, but “the scale and sophistication of this operation demonstrate the continued evolution and effectiveness of malvertising.”
Now it appears that AdGholas simply changed tactics, and within a couple of months launched a new campaign described in an ESET research paper published yesterday. In a detailed analysis, ESET doesn’t name the threat actors and calls the exploit kit (EK) involved Stegano. Further background information has been provided by Malwarebytes naming the actors as AdGholas, and the EK as Astrum. Stegano and Astrum are just different names for the same EK.
What sets this campaign apart from other and earlier campaigns is the extent of its stealth. When the ad data is first delivered, the campaign uses server-side logic on the potential victim’s returned computer data to decide whether to deliver a malicious banner or a clean banner. If it delivers the malicious version, the code is hidden by steganography: specifically within the parameters controlling the transparency of each pixel. The result is only a minor change to the color tone of the image, invisible to the naked eye.
Ultimately, the hidden code leads to the Astrum exploit kit — but neither automatically nor necessarily. The malicious code first uses a known Internet Explorer vulnerability CVE-2016-0162 to check for any sign of monitoring or analysis. If it detects a sandbox, or virtualization or certain security products it stops. Otherwise it sets up a one pixel iframe and redirects, via TinyURL, to the EK landing page.
The EK checks for Internet Explorer and loads a Flash file with three encrypted exploits. If it detects a vulnerable Flash version, the relevant exploit is run — otherwise, once again, it stops. If successful, writes ESET in an accompanying overview post, “the bad guys have all they need to download and execute the malware of their choice. Some of the payloads we analyzed include banking trojans, backdoors and spyware, but the victims could end up facing a nasty ransomware attack, for example.”
The two main payloads detected by ESET are Ursnif and Ramnit. Ursnif has modules for stealing email credentials, keylogging, screenshots and a backdoor, and seems to be targeting the corporate sector. Ramnit is financial fraud malware that targets the banking sector.
The scary part of this campaign is that it requires no user interaction at any stage. If the user visits an affected news site with a vulnerable browser and vulnerable Flash (and is in one of the targeted geographical areas) then malware execution could be entirely automatic and unseen. If any of those requirements are not met, then the malicious banner simply remains dormant and its malicious code invisible.
The two banners known to ESET are both for apparent security products: Browser Defence (notice the spelling) and Broxu. The spelling fits with the targeted regions. Malwarebytes separately comments, “The interesting aspect about this malvertising campaign is that the US was not one of the targets. Instead we saw Canada, the UK, Australia, Spain, Italy, and Switzerland as the most active geolocations.” Of these, Canada and the UK were the most targeted.
ESET has avoided mentioning the news sites afflicted by the adverts. Disclosure, it says, would not have added any value to the research analysis; rather it could give a false sense of security to users who had not visited those particular sites when “the banners could have appeared on practically any website that displays ads.”
Malwarebytes has been less reticent. “Despite not targeting the US, the latest AdGholas campaign has once again reached epic proportions,” wrote lead malware intelligence analyst Jerome Segura, “and unsuspecting users visiting top trusted portals like Yahoo or MSN (not to mention many top level publishers) were exposed to malvertising and malware if they were not protected.”
Since it is impossible to avoid coming across stealthy malvertising, protection is the only defense. This would include using one of the more secure browsers such as Chrome, Edge or Firefox; not using Flash; and maintaining mainstream and up-to-date anti-virus protection.
As of yesterday, this campaign was still operating. “At the time of posting the campaign still continues,” wrote Segura, “although the major ad networks have been informed and ‘should’ no longer be involved.” But even when this campaign closes, AdGholas will most likely return later with a new campaign and new tricks. “There is no doubt that the adversary is very advanced and has been clever to fly under the radar for long periods of time,” he comments.