Top websites affected by Angler exploit kit malvertising, security vendors say

The attacks delivered a backdoor called BEDEP and sometimes the TeslaCrypt ransomware

Tens of thousands of Web browsers may have been exposed to ransomware and other malware over the last few days after malicious advertisements appeared on high-profile websites, security vendors said Monday.

The malicious advertisements are connected to servers hosting the Angler exploit kit, a software package that probes a computer for software vulnerabilities in order to deliver malware, Trend Micro said.

Security vendor Trustwave wrote on Monday that it also detected a large Angler-related malvertising campaign.

It wasn't immediately clear if both vendors were writing about the same campaign. Both did note in their blog posts that the campaign delivered a backdoor called BEDEP, which allows an attacker to place other malware on a computer.

Trustwave said in some cases it saw the attack deliver BEDEP and TeslaCrypt, a type of file-encrypting malware.

The attackers Trustwave studied appeared to have gained control of a domain called "brentsmedia[dot]com" that at one time may have been used for online advertising.

"BrentsMedia was probably a legitimate business, and though we can't know Angler's side of this story for sure, it's likely that the people behind Angler are trying to ride on the reputation the domain had and abuse it to trick ad companies into publishing their malicious ads," Trustwave wrote.

Several high-profile websites pulled a JSON file from brentsmedia[dot]com as part of loading advertisements shown on their sites, Trustwave wrote. The JSON file had 12,000 lines of heavily obfuscated JavaScript, which was suspicious.

The JavaScript in part tries to figure out if certain security products or tools are running a computer. If none are, it loads a landing page from another domain hosting the Angler exploit kit, Trustwave wrote.

The malicious ads were hosted by two online advertising companies, one of which immediately killed the offending ad after being notified by Trustwave. The other company couldn't be reached.

The affected sites included and, Trustwave said. Trend Micro didn't identify the publishers it saw were affected.

There's little publishers can do to stop malvertising since online advertising companies should be vetting and filtering malicious ones. Although detecting malicious ads is getting better, it's far from perfect.

Placing a malicious ad on a highly trafficked website means an attacker could potentially infect many computers in a very short period of time, offering a great advantage over simple spam.

The Angler campaign observed by Trend may have "affected tens of thousands of users in the last 24 hours alone," wrote Joseph C. Chen, a Trend Micro fraud researcher.

"Based on our monitoring, the malicious ads were delivered by a compromised ad network in various highly-visited mainstream websites–including news, entertainment and political commentary sites," Chen wrote.

"As of this writing, while the more popular portals appear to be no longer carrying the bad ad, the malvertising campaign is still ongoing and thus continues to put users at risk of downloading malware into their systems," he wrote.

Join the CSO newsletter!

Error: Please check your email address.

Tags software packageBEDEPsecurityAngler exploit kitTeslaCryptsoftware

More about Trend MicroTrustwave

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts