Legal Advertising Technologies Helped To Spread Trojans

The criminal structure was discovered by the Confident IB, who named it Zirconium.

The first agencies were registered in February 2017. Attackers created a separate website for each fake ad agency. They used stock photos to establish profiles of managers in social networks. Crooks also automated publication of news posts in social media. Each agency worked on the basis of its own, independent IT infrastructure, which included SSL-servers, hosting facilities, an advertising engine for displaying banners.

The goal of the initial stage was to lull possible suspicions of the large advertising platforms with which the scammers interacted in the second stage of the operation.

"Agencies" bought banner ads from legitimate sites. Then, through the chain of automatic redirects, they took visitors to the malicious sites. Special JavaScript was involved to move the user to a new page without any action on his part.

The first website that opened after users clicked on the banner served as a gateway and sent the visitor to an intermediate resource to create a fingerprint. This procedure allows you to analyze traffic and break it into segments in order to increase the effectiveness of advertising.

Then the user got onto another “gasket” website, which distributed the audience between the landing pages. Final destination websites usually showed fake alerts about the allegedly outdated Flash Player, and a proposal to install some software. All this led to the infection of the computer with various malware including Trojans and even ransomware. Victims ended up losing their data and money.

Fraudsters sought to improve the effectiveness of their campaigns with the help of better targeting - another feature that makes Zirconium similar to classic marketing agencies.

It is noteworthy that Zirconium often did not own the pages on which the victim eventually ended up. Like traditional agencies, attackers resold traffic, earning commissions.

The fraudulent network bought approximately 60% of all online advertising spots offered by major ad networks on weekly basis. Almost all the victims who got tricked by Zirconium rogue ads live in the US.

Mobile devices remained safe, all advertising campaigns focused on desktop computers and laptops. The operating system did not matter, criminals were attacking Windows, Mac, Linux and Chrome OS.

Working with legitimate advertising platforms and successfully camouflaging under numerous small agencies helped criminals stay unnoticed for most of 2017. In October, cybercriminals began using fingerprint scripts more actively, which attracted the attention of security experts.

Security analysts studied the structure of the fake advertising conglomerate and found offshore companies with Seychelles addresses among its owners. Many of these Seychelles companies have been already known for other fraudulent schemes like semi-legal Bitcoin exchanges, financial pyramids, etc. One organization turned out to be connected with the well-known Bitcoin exchange BTC-e.com, which was closed by the FBI in the summer of 2017.

Check the comment section for additional information, or share what you know or ask a question about this article, by clicking the 'View or Write Comment' button below.

Note: Some of the information in samples on this website may have been impersonated or spoofed.