Massive Malvertising Campaign Shut Down by Cisco and GoDaddy

[Exterminator]

A malvertising campaign that affected users all over the globe was recently brought to a halt following the cooperation between Cisco Talos and GoDaddy.

Every day there are tens of different cyber-crime campaigns affecting users. Just to name a few, we have AdGholas, EITest, VirtualDonna, GooNky, Darkleech, Pseudo-Darkleech, wordJS, and more.

Behind these campaigns are cyber-crime groups that hack websites and/or create malicious ads in order to drive traffic (users) to special servers called "gates."

These gates check the user's browser and OS, and if certain criteria is met, they redirect him to another server called the "landing page" where an exploit kit tries to infect the user with malware by using vulnerabilities in the outdated software detected by the gates.

ShadowGate crew targeted OpenX and Revive advertising servers
One of these cyber-crime campaigns that hijacks users from their regular web browsing experience is run by the ShadowGate crew, named this way because they use domain shadowing to host their activity.

Cisco researchers say that they've tracked down several campaigns carried out by this crew, which leveraged ads hosted through the OpenX and Revive advertising platforms.

The ShadowGate crew buys ads on advertising platforms that deployed OpenX and Revive advertising servers, which would allow them to add JavaScript code together with their advertisements.

ShadowGate campaign pushed CrypMIC ransomware
When these ads would show inside a user's browser, they would load a hidden iframe, which in turn would load a JavaScript file hosted on the gate, which was usually a shadow domain on a hacked website (malicious_subdomain.hacked_website.com).

This script would test the user for the usual gate-level checks, and if everything checked out, would load a Flash file from the exploit kit landing page, compromising the user with malware.

In most cases, this malware was the CrypMIC ransomware, as in the video below, and would not require any type of interaction from the user.