AdGholas
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2016-03-22
- Last seen
- 2016-03-22
- Updated
- 2026-10-12 15:55
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
AdGholas, also known by its alias, is a threat actor linked to Russia. The actor has been observed conducting malvertising campaigns that compromise social media platforms such as LiveJournal and another unnamed social site. In the 2016‑03‑22 incident, AdGholas used stolen credentials to create fraudulent subdomains, employed domain shadowing and fingerprinting techniques to evade detection, and distributed malicious ads via an ad network that leveraged Google open redirects to deliver the Angler exploit kit. The campaign targeted users with outdated or unprotected software by fingerprinting systems for missing security tools and exploited an Internet Explorer vulnerability to scan local hosts for security products and research environments. No public attribution to a state sponsor or criminal consortium has been made beyond the actor’s Russian location.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.