Kovter Group malvertising campaign exposes millions to potential ad fraud malware infections

Overview

Proofpoint researchers recently detected a large-scale malvertising attack by the so-called KovCoreG group, best known for distributing Kovter ad fraud malware and sitting atop the affiliate model that distributes Kovter more widely. This attack chain exposed millions of potential victims in the US, Canada, the UK, and Australia, leveraging slight variations on a fake browser update scheme that worked on all three major Windows web browsers. The attack has been active for more than a year and is ongoing elsewhere, but this particular infection pathway was shut down when the site operator and ad network were notified of the activity.

Background

Despite dramatic declines in exploit kit activity over the last year, malvertising remains a profitable enterprise for actors who can achieve sufficient scale and deliver malware effectively in a landscape where vulnerable machines are increasingly scarce. To improve infection rates and better evade detection by vendors and researchers, threat actors have turned to advanced filtering techniques and social engineering instead of the widespread use of exploits.

You can read their analysis in detail here: https://www.proofpoint.com/us/threat-insight/post/kovter-group-malvertising-campaign-exposes-millions-potential-ad-fraud-malware

The combination of large malvertising campaigns on very high-ranking websites with sophisticated social engineering schemes that convince users to infect themselves means that potential exposure to malware is quite high, reaching millions of web surfers. Once again, we see actors exploiting the human factor even as they adapt tools and approaches to a landscape in which traditional exploit kit attacks are less effective. While the payload in this case is ad fraud malware, it could just as easily have been ransomware, an information stealer, or any other malware. Regardless, threat actors are following the money and looking to more effective combinations of social engineering, targeting, and pre-filtering to infect new victims at scale.

If you just want the Indicators of Compromise:

ET and ETPRO Suricata/Snort Signatures

2823606 || ETPRO CURRENT_EVENTS Possible Evil Redirect Leading to EK Dec 04 2016

2022636 || ET INFO SUSPICIOUS Single JS file inside of ZIP Download (Observed as lure in malspam campaigns)

2018358 || ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1

2810582 || ETPRO TROJAN WIN32/KOVTER.B Checkin 2

References

https://www.proofpoint.com/us/threat-insight/post/video-malvertising-bringing-new-risks-high-profile-sites

https://www.proofpoint.com/us/threat-insight/post/The-Shadow-Knows

http://malware.dontneedcoffee.com/2015/10/a-doubleclick-https-open-redirect-used.html

https://www.proofpoint.com/uk/threat-insight/post/massive-adgholas-malvertising-campaigns-use-steganography-and-file-whitelisting

https://support.mozilla.org/en-US/kb/i-found-fake-firefox-update

https://twitter.com/compvla/status/810923447601790976

https://twitter.com/cbeatonssp/status/864949702638358529/photo/1

https://www.bleepingcomputer.com/news/security/skype-malvertising-campaign-pushes-fake-flash-player/

https://twitter.com/JAMESWT_MHT/status/867678039798403072

https://bartblaze.blogspot.co.uk/2017/09/malicious-adclick-networks-common-or.html

http://executemalware.com/?p=432

https://andywalpole.me/blog/140739/using-javascript-create-guid-from-users-browser-information

https://blogs.technet.microsoft.com/mmpc/2016/07/22/kovter-becomes-almost-file-less-creates-a-new-file-type-and-gets-some-new-certificates/

https://www.proofpoint.com/us/threat-insight/post/spike-kovter-ad-fraud-malware-clever-macro-trick

https://www.proofpoint.com/uk/threat-insight/post/microsoft-patches-CVE-2016-3298-second-information-disclosure-zero-day

https://www.proofpoint.com/us/threat-insight/post/kovter-group-malvertising-campaign-exposes-millions-potential-ad-fraud-malware 

Header image from: Image from https://twitter.com/malekal_morte