Long-running malvertising campaign infected thousands of computers per day

The AdGholas malvertising operation tricked ad networks and malware scanners using steganography

Security researchers have shut down a large-scale malvertising operation that used sophisticated techniques to remain undetected for months and served exploits to millions of computers.

The operation, dubbed AdGholas, has been running since at least October 2015. According to security vendor Proofpoint, the gang behind it managed to distribute malicious advertisements through more than 100 ad exchanges, attracting between 1 million and 5 million page hits per day.

The Proofpoint researchers estimate that 10 to 20 percent of computers that loaded the rogue ads were redirected to servers hosting exploit kits -- web-based attack tools that attempt to silently exploit vulnerabilities in popular applications in order to install malware.

The malvertising code used a series of complex checks to ensure that the visiting computers are not virtual machines used by security researchers or by ad networks themselves to discover malware.

Other checks were used to filter victims based on their geolocation and to serve certain malware programs, typically online banking Trojans, only to users in specific regions. This was likely done on request by the cybercriminal gangs behind those Trojans that paid the AdGholas group to distribute their malware.

In order to make it even harder for ad networks and security scanners to discover the attacks, the AdGholas group used steganography -- the technique of hiding code inside images. The rogue ads contained images with encrypted JavaScript code inside that was only extracted and executed for selected computers passing the required checks.

This is the first time when the use of steganography has been observed in a malvertising attack, according to Proofpoint. The company's researchers worked with researchers from Trend Micro to deconstruct the attackers' technique and analyze it.

Proofpoint estimates that the AdGholas malvertising campaigns hit up to 1 million computers every day and infected thousands of them with malware. The operation was suspended on July 20 following action from members of the advertising industry.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?