14 DAY TRIAL // A malvertising campaign that affected users all over the globe was recently brought to a halt following the cooperation between Cisco Talos and GoDaddy.
Every day, there are tens of different cyber-crime campaigns affecting users. Just to name a few, we have AdGholas, EITest, VirtualDonna, GooNky, Darkleech, Pseudo-Darkleech, wordJS, and more.
Behind these campaigns are cyber-crime groups that hack websites and/or create malicious ads in order to drive traffic (users) to special servers called "gates."
These gates check the user's browser and OS, and if certain criteria are met, they redirect them to another server called the "landing page," where an exploit kit tries to infect the user with malware by using vulnerabilities in the outdated software detected by the gates.
ShadowGate crew targeted OpenX and Revive advertising servers
One of these cyber-crime campaigns that hijack users from their regular web browsing experience is run by the ShadowGate crew, named this way because they use domain shadowing to host their activity.
Cisco researchers say that they've tracked down several campaigns carried out by this crew, which leveraged ads hosted through the OpenX and Revive advertising platforms.
The ShadowGate crew buys ads on advertising platforms that deployed OpenX and Revive advertising servers, which would allow them to add JavaScript code together with their advertisements.
ShadowGate campaign pushed CrypMIC ransomware
When these ads showed inside a user's browser, they would load a hidden iframe. This, in turn, would load a JavaScript file hosted on the gate, which was usually a shadow domain on a hacked website (malicious_subdomain.hacked_website.com).
This script would test the user for the usual gate-level checks, and if everything checked out, it would load a Flash file from the exploit kit landing page, compromising the user with malware.
In most cases, this malware was the CrypMIC ransomware, as in the video below, and would not require any type of interaction from the user.
As you can see from the video, this campaign didn't give any hints to users that something was wrong. Users would end up with ransomware on their PCs, and they wouldn't know how it happened.
The ShadowGate crew compromised sites in Asia, Europe, North America, and the Middle East using this technique. The crooks didn't focus on high-profile sites like past malvertising campaigns, but also delivered ads to smaller websites.
Since a large number of the ShadowGate gate servers were hosted on servers and domains registered through GoDaddy, the two companies collaborated and had them all shut down.
During the past year, for its malvertising campaigns, ShadowGate used the Angler exploit kit to infect users but later migrated to the exploit kit rented by the Neutrino gang after Russian police arrested the Angler (Lurk trojan) group.