GINC-APT-0792 · Tracked, unattributed

HookAds

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Sources
3 sources carry it
Identifier
GINC-APT-0792 · hookads

What it is

HookAds is a malvertising campaign that purchases cheap ad space on low quality ad networks commonly used by adult web sites, online games, or blackhat seo sites. These ads will include JavaScript that redirects a visitor through a serious of decoy sites that look like pages filled with native advertisements, online games, or other low quality pages. Under the right circumstances, a visitor will silently load the Fallout exploit kit, which will try and install its malware payload.

Tools

The tools and malware families the sources tie to it.

  • BLACKCOFFEE
  • BlackEnergy
  • BlackHole
  • BlackNix
  • Blackshades
  • SPACESHIP
  • Xploit

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de