On Sunday April 10th the Fox-IT Security Operations Center (SOC) started to see an increase of exploit kit related incidents. The incidents originated from a large malvertising campaign hitting the Netherlands. The list of affected websites spreads across most of the popular Dutch websites. In total we’ve now seen at least 288 websites being affected. To give an impression of the impact, the list of affected websites includes:
- nu.nl
- marktplaats.nl
- sbs6.nl
- rtlnieuws.nl
- rtlz.nl
- startpagina.nl
- buienradar.nl
- kieskeurig.nl
- veronicamagazine.nl
- iculture.nl
- panorama.nl
Note: Malvertising is caused by malicious content providers in the advertisement ecosystem, and not caused by the affected websites themselves (f.e those listed above).
We’ve been in contact with the affected advertisement provider who responded quickly to the incident and has filtered the listed IOCs in their advertisement platform. They will be tracking down the affected content provider as this issue has not been fully resolved, it has simply been filtered for now. More information on malvertising can be found here: [ Malvertising: Not all Java from java.com is legitimate ].
Details of the exploit kit redirect
The malvertising is occurring through an advertisement platform which is actively used on the above mentioned websites. From the websites, external scripts are loaded which in turn redirect further towards the exploit kit. We’ve observed the Angler Exploit Kit being active on these redirects during this campaign. We have not seen any successful infections at our customer yet.
One of the redirects towards the Angler exploit kit as observed by our monitoring platform:
Indicators of Compromise (IOCs)
The following two domains have been observed to redirect the users from the affected websites towards the exploit kits. Blocking these two domains will aid in stopping the redirects for now:
- traffic-systems.biz (188.138.69.136)
- medtronic.pw (188.138.68.191)