text: Signed CryptoWall Distributed via Widespread Malvertising Campaign | Barracuda Labs
  Research >> Signed CryptoWall Distributed via Widespread Malvertising Campaign	Signed CryptoWall Distributed via Widespread Malvertising Campaign
  Posted by Barracuda Labs in Research | 2 comments
  This evening, Barracuda Labs' URL analysis system detected drive-by downloads originating from five Alexa top-ranked websites: hindustantimes[.]com, bollywoodhungama[.]com, one[.]co[.]il, codingforums[.]com, and mawdoo3[.]com. Threatglass entries for these sites are available here, here, here, here, and here.
  In every case, malicious content arrived via the site's use of the Zedo ad network. Specifically, the following subchain is common to every site's sequence of events.
  Upon successful compromise, an instance of CryptoWall ransomware is installed on the victim's system. The particular instance delivered via tonight's campaign has a valid digital signature and appears to have been signed just hours before its distribution.
  nbuuck / September 30, 2014
  A client of ours got hit with a drive-by ad that I suspect was a part of this outbreak. I'm having trouble reproducing the attack, however, now that the ad providers, Google, etc have intervened. I'd like to be able to reproduce it to evaluate why the client system was vulnerable (there are old versions of frequently exploited plugins, UAC was disabled, and the user was running as a local admin). Are there any live samples still accessible out there?
  Kalman Dee / October 21, 2014
  Comodo revoked a certificate on 14/08 after I contacted them (I have emails to prove it). Hopefully they didn't issue more after that; but perhaps they did…