Loading story…
Proofpoint reported that the AdGholas threat group used compromised advertising infrastructure to redirect users through the Astrum exploit kit and infect victims with Mole ransomware, including several universities in the United Kingdom. The activity was assessed to be broader than the publicly reported UK incidents, with targeting observed across multiple countries and likely infections in both the UK and the United States.
Researchers linked the campaign to infrastructure including Mole ransomware command-and-control at 137.74.163[.]43, Astrum infrastructure at 185.45.193[.]123, and compromised hosts such as avia-book[.]com used in the redirection chain. The operation relied on smart filtering, HTTPS, domain shadowing, and exploit-kit traffic, and Astrum was noted using vulnerabilities including CVE-2016-0189, CVE-2016-1019, and CVE-2016-4117; Proofpoint also said the addition of Diffie-Hellman in the chain may have been intended to conceal a new exploit, while banking Trojans were likely delivered to victims in other regions.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Researchers observed live AdGholas activity on June 16, 2017, though they were unable to trigger exploit-kit redirection in their lab. The observation supported the assessment that the campaign was active during the UK incidents.
Several universities in the United Kingdom reported ransomware attacks on June 15, 2017. These incidents were later assessed as likely part of a broader malvertising-driven campaign.
Proofpoint concluded that the June 2017 UK university ransomware incidents were likely caused by the AdGholas malvertising chain redirecting victims to the Astrum exploit kit, which then delivered Mole ransomware. The report also tied compromised hosts and infrastructure including avia-book[.]com, 185.45.193[.]123, and 137.74.163[.]43 to the activity.
Between June 14 and 15, 2017, Astrum was assessed to be dropping Mole ransomware in the United Kingdom and likely in the United States. Proofpoint linked the activity to the wider AdGholas malvertising chain.
At the end of May 2017, Astrum permanently adopted HTTPS for its exploit-kit infrastructure, according to the report. Researchers noted this as part of the chain later linked to AdGholas activity.
Proofpoint reported that the Astrum exploit kit experimented with HTTPS between March 30 and April 4, 2017, before later making broader use of it. This marked an infrastructure change in the exploit chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 40 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported two active intrusion patterns aimed at stealing credentials and maintaining access: a malvertising campaign that impersonated software brands such as **Notion** in Google search ads to deliver **Rhadamanthys** on Windows and **Atomic Stealer** on macOS, and a separate cyber-espionage operation by **Mantis** (also tracked as **Arid Viper**, **Desert Falcon**, and `APT-C-23`) targeting organizations in the Palestinian territories. In the malvertising chain, victims were redirected through intermediary domains, screened with browser-based anti-VM checks, and sent to fake download pages; the Windows installer fetched its payload from a URL hosted on TextBin, while researchers linked the advertiser account to “BUDNIK PAWEŁ” in Poland and noted thousands of views of the staging URL.
Jun 29, 2026
Proofpoint reported that malvertising campaigns were using **domain shadowing** to hide traffic redirection infrastructure and deliver the **Angler Exploit Kit**. Attackers abused legitimate domain registrar accounts to create large numbers of malicious subdomains under trusted parent domains, making the activity harder to detect and block while funneling victims from online advertisements to exploit landing pages. The technique allowed threat actors to rapidly rotate subdomains and maintain resilient redirect chains that blended into normal web traffic. By pairing malvertising with compromised domain management accounts, the operators increased the effectiveness of Angler EK delivery and complicated defensive efforts that relied on domain reputation or simple blacklist-based blocking.
Jun 29, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026