Legal Advertising Technologies Helped To Spread Trojans

Legal Advertising Technologies Helped To Spread Trojans

A group of cybercriminals has created 28 fake marketing agencies to buy advertising from websites and drive traffic to malicious resources. According to experts' estimates, in 2017 they showed their rogue ads more than a billion times, and the number of clicks on these ads exceeded 2.5 million.

The criminal structure was discovered by the Confident IB, who named it Zirconium.

The first agencies were registered in February 2017. Attackers created a separate website for each fake ad agency. They used stock photos to establish profiles of managers in social networks. Crooks also automated publication of news posts in social media. Each agency worked on the basis of its own, independent IT infrastructure, which included SSL-servers, hosting facilities, an advertising engine for displaying banners.

The goal of the initial stage was to lull possible suspicions of the large advertising platforms with which the scammers interacted in the second stage of the operation.

"Agencies" bought banner ads from legitimate sites. Then, through the chain of automatic redirects, they took visitors to the malicious sites. Special JavaScript was involved to move the user to a new page without any action on his part.

The first website that opened after users clicked on the banner served as a gateway and sent the visitor to an intermediate resource to create a fingerprint. This procedure allows you to analyze traffic and break it into segments in order to increase the effectiveness of advertising.

Then the user got onto another “gasket” website, which distributed the audience between the landing pages. Final destination websites usually showed fake alerts about the allegedly outdated Flash Player, and a proposal to install some software. All this led to the infection of the computer with various malware including Trojans and even ransomware. Victims ended up losing their data and money.

Fraudsters sought to improve the effectiveness of their campaigns with the help of better targeting - another feature that makes Zirconium similar to classic marketing agencies.

It is noteworthy that Zirconium often did not own the pages on which the victim eventually ended up. Like traditional agencies, attackers resold traffic, earning commissions.

The fraudulent network bought approximately 60% of all online advertising spots offered by major ad networks on weekly basis. Almost all the victims who got tricked by Zirconium rogue ads live in the US.

Mobile devices remained safe, all advertising campaigns focused on desktop computers and laptops. The operating system did not matter, criminals were attacking Windows, Mac, Linux and Chrome OS.

Working with legitimate advertising platforms and successfully camouflaging under numerous small agencies helped criminals stay unnoticed for most of 2017. In October, cybercriminals began using fingerprint scripts more actively, which attracted the attention of security experts.

Security analysts studied the structure of the fake advertising conglomerate and found offshore companies with Seychelles addresses among its owners. Many of these Seychelles companies have been already known for other fraudulent schemes like semi-legal Bitcoin exchanges, financial pyramids, etc. One organization turned out to be connected with the well-known Bitcoin exchange, which was closed by the FBI in the summer of 2017.

Check the comment section below for additional information, share what you know, or ask a question about this article by leaving a comment below. And, to quickly find answers to your questions, use our search Search engine.

Note: Some of the information in samples on this website may have been impersonated or spoofed.
Was this article helpful?  +
Share this with others:

Comments, Questions, Answers, or Reviews

There are no comments as yet, please leave one below or revisit.

To protect your privacy, please remove sensitive or identifiable information from your comments, questions, or reviews. We will use your IP address to display your approximate location to other users when you make a post. That location is not enough to find you.

Your post will be set as anonymous because you are not signed in. An anonymous post cannot be edited or deleted, therefore, review it carefully before posting. Sign-in.

Write Your Comment, Question, Answer, or Review

Legal Advertising Technologies Helped To Spread Trojans