Wiki › Techniques, Tactics & Procedures (TTPs) › Initial Access › Malvertising-Based Initial Access

Malvertising-Based Initial Access

3 min read

Jump to:

Overview

Malvertising-Based Initial Access is a technique where adversaries leverage malicious online advertisements to deliver malware or redirect users to compromised websites as an entry point into a target environment. This approach is commonly used during the initial access phase of an attack lifecycle to exploit user trust in legitimate advertising networks and web content. By embedding malicious payloads within ads, attackers can compromise endpoints without requiring direct interaction beyond visiting a legitimate site.

Attack Objective

Gain initial foothold within a target network or system
Supports the Initial Access stage of the attack lifecycle
Facilitates subsequent execution, persistence, and lateral movement by establishing a compromised endpoint

How the Technique Works

Adversaries inject malicious code or redirect URLs into online advertisements distributed through legitimate ad networks or compromised websites. When users load pages containing these ads, the malicious content can exploit browser or plugin vulnerabilities, prompt drive-by downloads, or redirect users to exploit kits or phishing sites. This results in the silent installation of malware or credential capture, enabling attackers to establish a presence within the victim environment.

Common Methods & Variations

Embedding exploit kits or malware payloads within banner ads or video advertisements
Redirecting users to malicious landing pages via compromised ad networks or third-party websites
Targeting both on-premises and cloud-accessible endpoints through web browsers
Use of living-off-the-land techniques by leveraging legitimate ad delivery infrastructure to evade detection
Variations include drive-by downloads, phishing via ad redirects, and exploitation of browser vulnerabilities

Indicators of Compromise (IOCs)

Unusual network traffic to known malicious ad servers or exploit kit domains
Browser crashes or unexpected behavior following ad exposure
Detection of suspicious scripts or executables downloaded from ad-related URLs
Endpoint alerts related to exploitation attempts or malware installation originating from web browsers
Logs showing redirection chains involving advertising domains

Detection Strategies

Monitoring web proxy and DNS logs for connections to suspicious or newly registered ad domains
Behavioral detection of anomalous browser activity and unexpected process launches
Correlation of endpoint telemetry with network events indicating drive-by download attempts
Signature-based detection of known exploit kit payloads or malicious ad scripts
Use of threat intelligence feeds to identify malicious ad infrastructure

Mitigation & Prevention

Implement web filtering and ad-blocking solutions to reduce exposure to malicious advertisements
Maintain up-to-date browser and plugin software to mitigate exploitation of known vulnerabilities
Enforce least privilege policies and application sandboxing to limit impact of browser-based compromises
Use network segmentation and egress filtering to control outbound connections to untrusted domains
Educate users on risks associated with unsolicited web content and encourage cautious browsing behavior

Response Considerations

Immediately isolate affected endpoints to prevent lateral movement
Conduct forensic analysis of browser histories, downloaded files, and network logs to identify infection vectors
Identify and block malicious ad domains and URLs within network controls
Remediate compromised systems by removing malware and applying security patches
Review and strengthen web access policies and endpoint protections to prevent recurrence

Related Techniques

Drive-by Compromise – often used in conjunction to exploit browser vulnerabilities
Phishing via Web Redirects – malicious ads redirecting to credential harvesting sites
Execution through User Execution – relies on user interaction with malicious content
Persistence via Browser Extensions or Scheduled Tasks – follow-on actions after initial compromise

Mapping & References

MITRE ATT&CK T1190 – Exploit Public-Facing Application
MITRE ATT&CK T1204 – User Execution
MITRE ATT&CK T1189 – Drive-by Compromise
Public research on malvertising campaigns by security vendors and CERT advisories
Incident reports detailing malvertising as an initial access vector in targeted attacks

Tags: Attack Lifecycle browser security Cybersecurity endpoint security exploitation Initial Access Malvertising Malware Delivery network security Threat Detection