Malvertising Campaign Delivers Millions of Bad Ads
By using the HiBids advertising platform, cyber-criminals have been delivering malicious advertisements to millions of victims worldwide in a large-scale malvertising and banking Trojan campaign, according to researchers at Check Point.
These malicious ads can infect the PC or mobile device of the person viewing the ads with malware, such as a crypto-miner, ransomware or a banking Trojan. Master134, the criminal reported to be responsible for the campaign, redirected stolen traffic from over 10,000 hacked WordPress sites, then sold it to Adsterra, the real-time bidding (RTB) ad platform, according to today’s blog post.
From there, Adsterra sold the traffic to advertising resellers, including ExoClick, AdKernel, EvoLeads and AdventureFeeds, which passed it on to the highest-bidding ‘advertiser.’ “Our discovery revealed an alarming partnership between a threat actor disguised as a Publisher and several legitimate Resellers that leverage this relationship to distribute a variety of malware including Banking Trojans, ransomware and bots,” researchers wrote.
The key to the campaign's success was that the advertisers were seemingly legitimate companies; however, they were actually criminals looking to distribute ransomware, banking Trojans, bots and other malware, which is how the infected ads – not legitimate ads – appeared on thousands of publishers’ websites worldwide.
During this campaign, which is still active, Check Point reportedly saw 40,000 clicks per week on these malicious ads. Cyber-criminals, who measure the return on investment of their ad spend by comparing it to the money they make from crypto-mining and ransom, are compromising the legitimate business of online advertising, exploiting it to display malware-infected ads.
Recognizing that threat actors will always search for new ways to spread their attack campaigns, researchers anticipate seeing more of these types of attacks, though the involvement of seemingly legitimate online advertising companies is of great concern. “We can’t help but wonder – is the online advertising industry responsible for the public’s safety? Indeed, how can we be certain that the advertisement we encounter while visiting legitimate websites are not meant to harm us?” the researchers wrote.
- Security Monitoring and Vulnerability Analyst, End User. PCI Level 1 Service Provider.
CH7843 Security Monitoring and Vulnerability Analyst, End User. Level 1 Service Provider. £50,000 London Security Monitoring and Vulnerability Analyst needed to join an Level 1 Service Provider. The Security Analyst will be responsible monitoring, configuring, fine tuning and generally improving the security tool capability. Specific experience with Tripwire Log Center and Tripwire Enterprise is highly desirable. Other security tools experience should include the managing and monitoring of firewalls, Anti Phishing, AV, vulnerability management, IAM etc. Current experience with Vulnerability management and penetration testing is highly desirable. Specifically the ability to effectively manage 3rd party pen tests. Hands on penetration testing is a very nice to have. You will be working within a specialist security team reporting to the CISO. Experience working within an end user environment within financial services is highly desirable. Flexible location. This is an exclusive role to DCL Search & Selection. https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-role-clone
- Internal Security Auditor, Level 1 Service Provider (ISO27001)
- Upto 65,000 plus benefits
Internal Security Auditor ISO 27001, PCI, needed to join a Cyber team within this expanding Fintech business. The Internal Security Auditor will have end to end responsibility for planning, delivering, remediating any findings etc. Experience working within financial services is highly desirable. This Is a great time to join a newly formed and growing Cyber team within a rapidly expanding fintech, that is taking a major share of its market. We are looking for someone with experience, (but not to be limited to) a mix of Information Security standards, frameworks, audit principles, controls / policies and the management and use of the technical tooling etc. ISO 22301, ISO 27001, NIST Cybersecurity Framework etc An ideal candidate will be working within an end user environment with a cyber consultancy background. Experience taking a company through accreditation is highly desirable Experience managing internal stakeholders, technical teams and external third parties essential Flexible working, but with the ability to get into London. This is an exclusive role to DCL Search & Selection.
- DevOps Engineer with IdAM
- Upto £80,000 plus benefits
We are ooking for an DevOps engineer, idealy with IdAM (identity access Management) experience, this is a senior role for someone that can be the lead hands on person on a project. Your role will be to work on the deployment project implementing the solution into the exsiting application so will be used to connect an applications into mulipe 3rd party appliactions. We Would look at someone who has done DevOps with Security and can cross train into IdaM, but preference would be given to someone with the IdAM experience this is a great opportunity to join a consultancy that work on some truely amazing and differnet solutions
- Senior SOC Analyst. Level 3 Palo Alto Wildfire, Rapid 7, Fortify, Splunk.
REF CH7840 Senior SOC analyst (Palo Alto Wildfire, Rapid 7, Fortify AND Splunk) Flexible location £55,000 + Senior SOC analyst needed (Level 3) that can achieve SC clearance for a permanent role. We are looking for Level 3 SOC Analysts with two or more of the following; Palo Alto Networks Wildfire (#malware) Rapid7 Nexpose Micro Focus Fortify (#automated #applicationsecurity) AND ideally Splunk. The role will include, but not be limited to; managing and handling incidents end to end, supporting and mentoring level 1 / level 2 staff, supporting the SOC manager in the delivery of the SOC roadmap, engaging with the client stakeholders (other technical teams) as and where needed, use case development, advanced search and reporting etc. Flexible location, commutable in the future to London or Birmingham This role will sit within a public sector client so the individual must be able to achieve SC clearance. To arrange a call with Chris Holt use this calendy link https://calendly.com/chris-holt/arranged-call-with-chris-holt-remote-soc-role Chris.Holt@dclsearch.com 07884666351