• by Laurie Sullivan  @lauriesullivan, April 17, 2015

Researchers at Malwarebytes Labs have discovered another malvertising campaign, likely from the same group responsible for the recent attack on The Huffington Post and Zillow. An ad was used to deliver the Cryptowall ransomware via an ad built in Flash.

This new malicious campaign involves Google's DoubleClick ad network.

Jerome Segura, senior security researcher at Malwarebytes, said the latest malvertising attack was carried through merchenta, a company that provides a platform for ad exchange and direct integrations with top publishers, according to Malwarebytes. Merchenta boasts 28 billion monthly impressions in the U.S., 14 billion in the U.K., 18 billion in EMEA, and 9 billion in Asia. The company works with top-tier ad networks, such as Google DoubleClick, and real-time bidding platform Biddable. 

DoubleClick is not directly responsible for loading the malicious ad, but it starts the chain with publishers, which unfortunately have little control over transactions that follow.

The criminals posed as an advertiser, infiltrating the platform via a third party and managed to house a malicious advertisement directly on merchenta's ad platform that fed into Google's DoubleClick channels, according to Malwarebytes. Within minutes, the malicious ad had infected 95% of the ads running on the network in United States, the United Kingdom and Europe, exposing a huge number of people worldwide.

The Flash ad hosts the malware. Using the ad will redirect to another page. In this case, individuals do not need to click on the ad before infecting a computer. That's a big misconception. As the ad server loads the Web page on the individual's screen, the malware downloads the malicious software onto the computer.

"We call it a drive-by download," said Segura. "You surf the Web, the ad loads on the screen, the computer gets infected. It happens within seconds."

The latest example is another reminder of one of the weaknesses with online advertising. The biggest weakness involves ad networks relying on third-party "trustworthy" data. Vulnerabilities in Flash technology present another problem, Segura said. The majority of ads use Flash, although some companies have begun building ads using HTML5. If the ad network can host the ad it becomes less of a problem, he said.

Malwarebytes worked with ClarityAd to confirm the malicious attack that began last weekend, which showed a well-known ad network with direct ties to Google's DoubleClick being caught in a large malvertising incident. Several well-known sites were affected, such as Hermes Paris.

UPDATE: Neil McClements, merchenta CEO, disagrees. In an email he insists the company has "zero tolerance for malware" and is working hard to prevent this type of disruption.