Cyber Incident Victim: The Guardian
Date:
Dec 2015
Location:
United Kingdom
Summary
The Guardian experienced a cyber incident where an article on cybercrime inadvertently redirected visitors to the Angler Exploit Kit, causing malware infections. The attack exploited Windows OLE Automation vulnerabilities via VBScript and leveraged Flash exploitation to deliver ransomware payloads, predominantly Teslacrypt, which encrypted files and demanded Bitcoin payments. This compromise occurred through direct page visits rather than malicious advertisements, with the publication acknowledging and addressing the issue. The Angler kit had previously targeted other high-traffic websites through malvertising campaigns, WordPress exploits, and zero-day Flash vulnerabilities, establishing itself as a prominent threat following the decline of the Blackhole exploit kit.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 11, 2015, cybersecurity researchers identified that a Guardian article discussing escalating cybercrime risks had itself become an infection vector delivering the Angler Exploit Kit. Visitors accessing the article were silently redirected to malicious landing pages hosting Angler, which executed drive-by download attacks without requiring ad interactions or additional clicks. The exploit chain leveraged multiple vulnerabilities, including CVE-2014-6332—a memory corruption flaw in Windows OLE Automation exploitable through VBScript in Internet Explorer—and embedded Flash objects dynamically configured at runtime. Angler's server evaluated visitor systems to determine whether to deploy Flash exploits, using cryptographic parameters (Diffie-Hellman constants g and u) and payload URLs. Successful exploitation resulted in malware infections, predominantly ransomware strains like Teslacrypt, which encrypted local files, network drives, and cloud-synced storage while demanding Bitcoin payments for decryption.
FireEye first detected the compromise and notified The Guardian, which acknowledged the issue and initiated remediation efforts. This incident occurred amid sustained Angler Exploit Kit activity throughout 2015, including prior attacks via malvertising on MSN.com, Daily Mail, Reader’s Digest, and adult websites, as well as a zero-day Flash exploit in January. Angler had emerged as a dominant threat following the decline of the Blackhole exploit kit, with Cisco researchers highlighting its prevalence earlier that year. Analysis by Sophos indicated Angler primarily targeted Internet Explorer (59% of cases) and Flash Player (41%), delivering ransomware in over 50% of infections. The Guardian compromise exemplified Angler’s evolving tactics, shifting from tainted advertisements to direct compromises of legitimate article pages, broadening potential victim exposure through trusted news domains.