Dutch news site nu.nl loaded infected advertisements on 05 June 2013

On 05 June 2013 the Dutch news site nu.nl loaded infected advertisement(s).

See blog by Fox-IT; both in Dutch and English:
http://blog.fox-it.com/2013/06/06/geinfecteerde-advertenties-op-nu-nl/

It seems to have been a new variant of banking malware Zeus.

 

Lots of Dutch sites reporting it too, most if not all of them linking to the Fox-IT blog.
To name some of them:

http://tweakers.net/nieuws/89533/nu-punt-nl-serveerde-urenlang-malware.html

http://webwereld.nl/beveiliging/78043-nu-nl-verspreidt-urenlang-malware---update

http://www.pcmweb.nl/nieuws/nunl-besmet-bezoekers-met-banking-trojan.html

http://www.computeridee.nl/nieuws/nunl-verspreidde-malware

https://www.security.nl/artikel/46539/1/Gevaarlijke_malware_verspreid_via_NU.nl.html

http://www.volkskrant.nl/vk/nl/2694...ezoekers-NU-nl-geinfecteerd-met-malware.dhtml

=====

Erik Loman (SurfRight - HitmanPro) posted about it in the HMP thread here.

Maybe someone would be so kind to post his Tweets (for those who don't use Twitter).

 

According to the Fox-IT blog only two malware scanners were detecting it when scanned at VirusTotal at the time of the infection. That doesn't have to mean much, as we know. Settings at VT might be different compared to settings on a particular computer. I do not want to start that discussion again! Anyway, much more scanners at VT seem to detect it now.

 

Maybe the nice folks @ http://www.nucia.eu/ would like to know or perhaps are aware.

 

Yep, thanks. It is already posted there as I just saw:
http://www.nucia.eu/forum/threads/70352-Nieuwssite-NU-nl-verspreidde-malware

 

They are aware of this three days old incident.

 

Since I am obviously not Dutch, Gerard, I was only adding the Nucia site as an option in which to report this issue in assistance to the Original Poster.
See TOS entry: https://www.wilderssecurity.com/showpost.php?p=72229
However:This is good to know regardless of age.

 

Hey Silj and Gerard,

I'm sure that you both posted with all good intentions!
And as for me, I know I was a bit late posting it.

As can be read from the Fox-IT blog, the advertisement at nu.nl was loaded from a provider with compromised OpenX install, and the redirect was serving exploit kit "Sweet Orange Exploit Kit".

I think I will end my posts in this thread with a link to the official Dutch governmental site National Cyber Security Centre:
http://www.waarschuwingsdienst.nl/R...-53 Nieuwssite NU.nl verspreidde malware.html

 

Voila, we have closure.