Hacked Ad Server Pushes SEON Ransomware, Trojans Via Malvertising

guest · Jun 27, 2019

Hacked Ad Server Pushes SEON Ransomware, Trojans Via Malvertising
June 27, 2019
https://www.bleepingcomputer.com/ne...hes-seon-ransomware-trojans-via-malvertising/

The ad server for a very popular video converter site was hacked to display malvertising that loads the GreenFlash Sundown exploit kit. This exploit kit would then drop the SEON Ransomware, Pony information stealing Trojan, and miners on a vulnerable computer.

"The threat actors behind it have a unique modus operandi that consists of compromising ad servers that are run by website owners," stated Malwarebytes researcher Jérôme Segura in a blog post. "In essence, they are able to poison the ads served by the affected publisher via this unique kind of malvertising."

From network traffic captured by Segura, you can see how the malvertising attack worked below. A user would visit the site, the ad server would deliver the fake GIF, which would then load code from a series of sites that ultimately loaded up the exploit kit.
In addition to the SEON Ransomware being installed, the exploit kit will also install a miner and the Pony information stealing Trojan.
Click to expand...

Malwarebytes: GreenFlash Sundown exploit kit expands via large malvertising campaign

Log in or Sign up

Hacked Ad Server Pushes SEON Ransomware, Trojans Via Malvertising

guest Guest

Log in or Sign up

Hacked Ad Server Pushes SEON Ransomware, Trojans Via Malvertising

guest Guest

Useful Searches