Revive ad servers being hacked to distribute malicious ads

mood · Apr 22, 2020

Revive ad servers being hacked to distribute malicious ads
April 22, 2020
https://www.bleepingcomputer.com/ne...ers-being-hacked-to-distribute-malicious-ads/

The Tag Barnakle malvertising group is hacking into Revive ad servers to inject and deliver malicious advertisements on unwary visitors.

One open-source self-hosted platform that has been around for the past ten years is called the Revive ad server.
Just like any application, Revive has had its share of vulnerabilities that can be used to inject malicious advertisements into web sites that utilize the ad server.

In a new report by advertising security firm Confiant, we can see how one malvertiser known as Tag Barnakle is mass-compromising Revive ad servers to inject their own code into a publisher's existing advertising campaigns.

"In recent months, we have seen a wave of malvertisements that are attached to Revive creatives spanning dozens of instances of ad servers, including those owned and operated by publishers and ad networks," Confiant security researcher Eliya Stein explained in a report.
Click to expand...

Stein told BleepingComputer that these fake Adobe Flash player updates install the Shalyer Trojan or other botnet bundlers onto macOS systems.

For Windows users, the sample shared with BleepingComputer installs an adware bundle such as InstallCore that is known to infect victims with ransomware, information-stealing Trojans, unwanted browser extensions, and other malware.
Compromised ad servers have a long reach
In one compromised RTB ad provider, Confiant saw up to 1.25MM malicious ad impressions being pushed out in a single day.

"If we take a look at the volumes behind just one of the compromised RTB ad servers — we see spikes of up to 1.25MM affected ad impressions in a single day. For context, Tag Barnakle has compromised ~60 ad servers in total," Confiant stated in their report.
Click to expand...

Confiant: Tag Barnakle: The Malvertiser That Hacks Revive Ad Servers, Redirects Victims To Malware

Log in or Sign up

Revive ad servers being hacked to distribute malicious ads

mood Updates Team

Researchers Dive Into Evolution of Malicious Excel 4.0 Macros

UK Ad Campaign Seeks to Deter Cybercrime

Streaming TV Fraudsters Steal Millions of Ad Dollars in ‘ICEBUCKET’ Attack

Malicious Actors Are Extensively Using CypherIT to Package Their Malware

'Waterbear' Employs API Hooking to Hide Malicious Behavior

Log in or Sign up

Revive ad servers being hacked to distribute malicious ads

mood Updates Team

Researchers Dive Into Evolution of Malicious Excel 4.0 Macros

UK Ad Campaign Seeks to Deter Cybercrime

Streaming TV Fraudsters Steal Millions of Ad Dollars in ‘ICEBUCKET’ Attack

Malicious Actors Are Extensively Using CypherIT to Package Their Malware

'Waterbear' Employs API Hooking to Hide Malicious Behavior

Useful Searches