The cybercriminal group behind the Angler browser-based attack managed to compromise GoDaddy by hosting Flash Player exploits on legitimate websites.
In the past two weeks, Adobe has been forced to issue two out-of-band security updates for Flash Player, patching two zero-day vulnerabilities ( CVE-2015-0310 and CVE-2015-0311 ).
This week, an additional security update is expected, as cybercriminals discovered a zero-day ( CVE-2015-0313 ) and created an exploit that is actively used against Internet Explorer and Mozilla Firefox users on any version of Windows .
The first two exploits are distributed via Angler, while the third is distributed via the Hanjuan exploit kit, according to independent researcher Kafeine.
Security researchers from Cisco have been monitoring Angler activity and noticed that with CVE-2015-0311 , the campaign started on January 26th, with the most active days being January 28th and 29th.
They found that cybercriminals used multiple layers of subdomainsto evade detection. During the investigation, approximately 1,800 domains associated with malware and exploit websites were identified by Cisco.
The strategy used by the attackers appears to involve compromising a large number of registered user accounts and setting up subdomains to deliver the malicious files.
Cisco says that the majority of the accounts controlled by the cybercriminals were registered through registrar and web hosting company GoDaddy. It may seem like a small number, but many of the accounts hold more than 45 unique domains, which significantly increases the means of distributing the malware.
Detecting malicious attacks is particularly difficult because the ads are provided by legitimate advertising networks and in most cases, each user is provided with a different banner, depending on their geographic location, interests, browser they use, and other parameters.
According to Cisco, the Angler exploit kit has been active for some time and continues to change to evade detection, and judging from January, it may have been involved in major attacks throughout the year.
