AdGholas

References:

The proof is in the cookie - 2014-11-05 - Malwarebytes - Jérôme Segura AdGholas Angler

Massive AdGholas Malvertising Campaigns Use Steganography and File Whitelisting to Hide in Plain Sight - 2016-07-28 - Proofpoint - Kafeine AdGholas Angler

Readers of popular websites targeted by stealthy Stegano exploit kit hiding in pixels of malicious ads - 2016-12-06 - Eset Astrum AdGholas

More Reading:

Operation Fingerprint: A Look Into Several Angler Exploit Kit Malvertising Campaigns - 2016-03-01 - MalwarebytesGeoEdge - Eugene Aseev - Jérôme Segura VirtualDonna GooNky AdGholas Angler

Microsoft Patches CVE-2016-3351 Zero-Day, Exploited By AdGholas and GooNky Malvertising Groups - 2016-09-13 - Proofpoint - Kafeine CVE-2016-3351 GooNky AdGholas Angler Astrum

Microsoft Patches IE/Edge Zero-day Used in AdGholas Malvertising Campaign - 2016-09-15 - Trend Micro - Brooks Li - Henry Li CVE-2016-3351 AdGholas

Peas in a pod: Microsoft patches CVE-2016-3298, a second information disclosure zero-day used in malvertising campaigns and the Neutrino Exploit Kit - 2016-10-11 - Proofpoint - Kafeine CVE-2016-3298 GooNky AdGholas CVE-2016-3351

CVE-2017-0022: Microsoft Patches a Vulnerability Exploited by AdGholas and Neutrino - 2017-03-24 - Trend Micro - Brooks Li - Henry Li CVE-2017-0022 AdGholas NeutrAds Neutrino

AdGholas Malvertising Campaign Using Astrum EK to Deliver Mole Ransomware - 2017-06-20 - Proofpoint - Kafeine AdGholas Astrum Mole

AdGholas Malvertising Campaign Employs Astrum Exploit Kit - 2017-06-20 - Trend Micro - Joseph C. Chen AdGholas Astrum Mole