Malvertising hits visitors to major news sites

Over the past weekend, a large number of websites have fallen victim to malvertising. In addition to the quantity, a relatively large number of large sites were also affected, such as the sites of The New York Times and the BBC.

The rogue ads targeted addresses in the United States. The victim sites were affected by actions related to the Angler Exploit Kit. Security company TrendMicro writes on its blog that the action has caused tens of thousands of victims over the weekend.

Malwarebytes writes that the activity around malvertising within their measurement capabilities seemed to decrease a bit in recent weeks until there were suddenly a lot of reports last weekend. The list of major sites in the US starts with MSN, The New York Times and the BBC. The ad networks that delivered rogue ads were from Google, AppNexus, AOL, and Rubicon.

Shortly before the malvertising campaign became big, Malwarebytes employees spotted a few infections at smaller publishers who were given the RIG exploit kit. On Sunday, the recently updated Angler exploit kit came into use. Among other things, Angler uses a recently fixed vulnerability in Silverlight. In addition to Silverlight, Angler uses vulnerabilities in unupdated versions of Flash. Angler infects users with the Trojan Bedep and, according to Spiderslabs, also with the TeslaCrypt ransomware. The ransomware only works on Windows computers, but the post does not elaborate on the ransomware.